Viking Therapeutics listed on ALPHV leak site following alleged SEC reporting failure

• Ransomware group: ALPHV
• Country: United States
• Sector: Healthcare
• Announcement date: December 18, 2023

ALPHV targets Viking Therapeutics in new leak site announcement

The ransomware group known as ALPHV (also referred to as BlackCat) has officially listed Viking Therapeutics on its dedicated leak site. In the announcement, which was posted on December 18, 2023, the threat actors claim that the biotechnology company has failed to fulfill its regulatory obligations. Specifically, the group alleges that the organization has not reported a recent cybersecurity incident and a subsequent breach of patient data to the U.S. Securities and Exchange Commission (SEC).

This incident highlights the escalating tension between ransomware groups and regulated entities. Ransomware leak sites are platforms used by cybercriminals to pressure victims into paying ransoms by threatening to release sensitive information. These groups often employ double-extortion tactics, where they not only encrypt an organization's systems but also steal sensitive data, threatening to publish it publicly to maximize leverage during negotiations.

Allegations of regulatory non-compliance

According to the claims made by the ALPHV group, the incident involves a failure to report a cybersecurity event within the required timeframe. The threat actors assert that Viking Therapeutics experienced a breach that compromised patient data but did not fulfill its legal obligation to notify the SEC of the occurrence. The group has suggested that if the organization does not address the situation as demanded, the stolen information may be released to the public.

The announcement includes certain evidence to support these claims, such as screenshots of a complaint filed by an employee to the SEC. However, it is important to note that the group has not provided any concrete samples of the leaked data to substantiate the scale or nature of the breach at this time.

Affected data types

• Patient data

About Viking Therapeutics

Viking Therapeutics is a clinical-stage biotechnology company. The organization is focused on the development of novel therapies for metabolic and endocrine disorders. Their pharmaceutical research is particularly concentrated in specialized areas such as weight management and liver diseases.

Implications and industry considerations

This incident may present significant risks for the organization regarding patient data privacy and its regulatory reporting obligations. For companies operating within the healthcare sector, a potential data breach can lead to severe sanctions under established regulations such as HIPAA. Furthermore, the failure to report incidents to the SEC can result in a loss of investor confidence and may trigger potential legal proceedings.

The ALPHV group is recognized for its technical sophistication, specifically for using Rust-based malware. If the allegations regarding the breach are accurate, the stolen data could potentially be utilized by malicious actors for targeted phishing attacks or identity theft.

For organizations in the healthcare and biotechnology sectors, maintaining robust cybersecurity postures is essential to protect sensitive information. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and ensuring comprehensive employee training to recognize social engineering attempts. Additionally, having a well-defined incident response plan that accounts for regulatory reporting requirements is a critical component of modern organizational resilience.