Wyoming County Community Health System targeted by Nokoyawa ransomware group

• Ransomware group: Nokoyawa
• Country: United States
• Sector: Healthcare
• Announcement date: May 23, 2023

Nokoyawa claims data exfiltration from Wyoming County Community Health System

The threat actor known as Nokoyawa has listed the Wyoming County Community Health System on its leak site. According to the group's announcement, they claim to have obtained approximately 150 GB of data from the organization's network. This claim was made on May 23, 2023, following an alleged attack that took place on May 12, 2023.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites often host lists of compromised organizations and, in many cases, samples of stolen data to increase the visibility of the attack. This specific incident involves a claim of a data breach rather than a simple encryption event, suggesting the attackers focused on stealing information to leverage against the victim.

Details of the alleged data theft

The announcement made by the Nokoyawa group alleges that the stolen information includes a variety of sensitive files. Based on the screenshots provided in the leak site announcement, the group claims to have access to a wide range of internal documentation and private information. The group asserts that the data includes financial statistics and personal information belonging to the organization.

Specifically, the data allegedly exfiltrated includes the following types of information:

• Financial data
• Patient information
• Administrative documents
• Medical records
• Mental health records

The inclusion of such diverse datasets suggests that the threat actors may have gained significant access to different departments within the organization's digital infrastructure. Such an event often utilizes double extortion tactics, a method where attackers not only encrypt an organization's systems but also threaten to leak sensitive data on a public forum to maximize the pressure for a ransom payment.

About Wyoming County Community Health System

Wyoming County Community Health System is a 62-bed, county-owned health system serving Wyoming County in New York, USA. It has been providing comprehensive healthcare services to the rural community for over 110 years.

Implications and risks for the healthcare sector

This incident highlights the significant risk of sensitive data exposure within the healthcare sector. Because the leaked data may contain highly private patient information, the organization could face legal consequences under regulations such as HIPAA. The exposure of medical and mental health records carries heavy implications for both the institution and the individuals involved.

For the individuals whose data was allegedly stolen, there are significant risks of identity theft or being targeted by sophisticated phishing attacks. When personal and medical information is leaked, it provides malicious actors with the necessary details to craft convincing fraudulent communications or to commit financial crimes.

From an organizational standpoint, such breaches can lead to severe operational disruptions and lasting reputational damage. While information regarding the Nokoyawa group remains limited, the nature of the claim suggests a targeted approach. To defend against these types of threats, organizations in the healthcare sector often implement various defensive measures, such as robust encryption, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized data exfiltration.