University Diagnostic Medical Imaging, PC targeted by fog ransomware group

• Ransomware group: fog
• Country: United States
• Sector: Healthcare
• Announcement date: March 13, 2025

The fog ransomware group has claimed responsibility for a data breach involving University Diagnostic Medical Imaging, PC. In an announcement posted on a leak site, the threat actor group asserted that they have successfully exfiltrated sensitive information belonging to the organization.

Details of the alleged incident

According to the announcement published on March 13, 2025, the threat actor known as fog listed University Diagnostic Medical Imaging, PC as a victim. The group claims that the data was obtained directly from the institution's networks. While the announcement was made on the same day as the claimed attack, the specific timeline of the initial intrusion remains unconfirmed.

The threat actor's post indicates that a significant volume of information is involved in this incident. Specifically, the group claims that 28.1 GB of data is available for distribution. However, attempts to verify the contents of the leak through the provided screenshots were unsuccessful, as the page displayed an error. Consequently, the actual contents of the alleged breach cannot be verified at this time.

Information regarding the claimed data

The listing provides no detailed information regarding the specific content of the allegedly leaked data. Because the associated screenshots failed to load due to technical errors, it is impossible to confirm the nature of the files or the specific types of information contained within the 28.1 GB of data mentioned by the group.

• No specific data types were named in the listing.

About University Diagnostic Medical Imaging, PC

University Diagnostic Medical Imaging (UDMI) is a radiology and medical imaging center located in the Bronx, New York. The institution provides various diagnostic imaging services to its patients, including MRI, CT scans, X-rays, and ultrasounds.

Impact and industry implications

This incident highlights the ongoing risks faced by institutions within the healthcare sector, where sensitive data is a primary target for cybercriminals. If the allegedly leaked data includes patient records or personal health information, it could trigger legal processes under strict regulations such as HIPAA. The exposure of such information can lead to secondary risks for the individuals involved, including the potential for identity theft or targeted phishing attacks.

In the broader context of cyber threats, ransomware groups often employ a tactic known as double extortion. In this scenario, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak this data on public forums or leak sites, the attackers aim to pressure the victim into paying a ransom to prevent the public disclosure of private information.

For organizations operating in the healthcare space, such incidents can have significant consequences. Beyond the immediate technical disruption, there are potential negative impacts on the institution's operational continuity and reputation management. Maintaining patient trust is vital, and a breach of sensitive medical imaging or diagnostic data can damage that trust significantly.

To mitigate these risks, organizations typically focus on robust defensive measures. This includes implementing strong access controls, maintaining regular backups, and conducting thorough network segmentation to prevent lateral movement by attackers. Furthermore, continuous monitoring and employee training are essential components of a proactive cybersecurity posture designed to detect and respond to unauthorized access before data can be exfiltrated.