Unimed Belem data allegedly leaked by RansomEXX

• Ransomware group: RansomEXX
• Country: Brazil
• Sector: Healthcare
• Announcement date: October 19, 2022

RansomEXX claims to have stolen data from Unimed Belem

The threat actor known as RansomEXX has published an announcement on its leak site, claiming to have obtained data belonging to the Brazilian healthcare organization Unimed Belem. This announcement, which appeared on October 19, 2022, marks a potential data breach involving a significant entity within the regional medical cooperative system.

Ransomware groups often employ a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat actors then threaten to release this stolen data on public leak sites if their demands are not met. This pressure is designed to maximize the impact of the attack by targeting the victim's reputation and legal standing.

Details of the alleged leak

According to the announcement made by the RansomEXX group, the stolen information is organized into 12 separate parts. The total size of the claimed data is 5.76 GB. Information regarding the specific nature of the leaked files remains limited, as the group has not provided specific details regarding the content of the data. The files are currently listed under the heading 'Offsite' within the group's announcement.

Publicly available information regarding the RansomEXX group remains limited, making it difficult to ascertain the full scope of their operations or their specific methodologies. When analyzing such incidents, it is important to note that the details provided by threat actors on leak sites are their own claims and have not been independently verified.

About Unimed Belem

Unimed Belem is a component of Unimed, which serves as the largest medical cooperative system in Brazil. The organization operates as a cooperative entity, providing a wide range of essential services including healthcare services, hospital operations, and various medical support services within its specific region.

Potential risks and organizational implications

The alleged leak of data from a healthcare provider poses significant risks to both patient privacy and institutional operational data. Because healthcare organizations handle sensitive personal information, such breaches can lead to secondary risks for both employees and patients, including the potential for identity theft or targeted phishing attacks.

Furthermore, under Brazil's LGPD regulations, an organization facing such a breach may encounter data breach notification requirements, which could potentially lead to administrative sanctions. Such incidents can also result in significant reputational damage and raise serious concerns regarding the security and integrity of the organization's supply chain.

To defend against these types of threats, organizations in the healthcare sector typically focus on several defensive strategies. These include implementing robust encryption for data at rest and in transit, maintaining strict access controls to limit data exposure, and conducting regular security awareness training for staff to prevent phishing. Additionally, maintaining comprehensive backups and a well-tested incident response plan is essential for mitigating the impact of a ransomware attack.