Westside listed on Royal ransomware leak site

• Ransomware group: Royal
• Country: United States
• Sector: Healthcare
• Announcement date: May 22, 2023

The Royal ransomware group has officially listed the healthcare organization Westside on its dedicated leak site. According to the announcement made on May 22, 2023, the threat actor group claims to have successfully obtained data belonging to the organization.

The claimed attack event

The incident was announced by the Royal ransomware group on May 22, 2023. In the listing posted on their leak site, the group claims to have gained access to the organization's internal information. The announcement specifically includes references to the organization's website and its financial information. While the group has made these claims publicly, the specific details regarding the breach remain limited to the information provided in the leak site listing.

Data involved in the claim

Despite the claims made by the threat actors, there is no detailed information regarding the specific nature of the leaked data provided in the record or the associated screenshot. The listing names no specific data types.

Organization profile

Westside Health is a community health organization based in Oregon, United States. The organization provides medical care and support services, with a primary focus on delivering healthcare to vulnerable populations and those with low incomes.

Risk assessment and industry implications

This leak announcement carries significant risks due to the nature of the organization's operations. Because Westside operates within the healthcare sector, the incident may carry the risk of exposing sensitive patient data. Such an event could potentially lead to legal sanctions and administrative fines under relevant regulations governing healthcare information.

The Royal ransomware group is assessed to have origins linked to the Conti group. This connection suggests that the attacks may be conducted using double-extortion methods. In a double-extortion scenario, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to leak it publicly unless a ransom is paid. This method increases the pressure on organizations to comply with demands to avoid reputational damage and regulatory penalties.

Furthermore, the organization and associated individuals may face ongoing risks, such as identity theft or targeted phishing attacks, resulting from the potential exposure of information. It is also noted that the Royal group reportedly continued its activities under the name BlackSuit in 2023, which suggests that similar techniques could be employed in future campaigns.

For organizations operating in the healthcare sector, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive strategies often include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to defend against phishing. Given the evolving nature of ransomware groups and their ability to transition between different identities, continuous monitoring and proactive threat intelligence are vital components of a modern defense strategy.