[BreachExchange] Missouri Hospital Is the Latest Victim of Ransomware

[Sophia Kingsbury]

https://www.campussafetymagazine.com/news/missouri-hospital-is-the-latest-victim-of-ransomware/

Missouri Delta Medical Center confirmed on Friday that one of its servers
was hacked by the Hive, a new ransomware group.

The attackers stole information from one of the medical center’s servers
and began posting private patient information online on September 9,
including patient Social Security numbers and medical information, reports
STLPR.

The ransomware attack occurred just as practically all of Missouri Delta
Medical Center’s ICU beds were full due to the region’s latest COVID-19
surge, reports KFVS. However, according to Missouri Delta, despite the
awful timing, the attack appears to not involve data from the hospital’s
main medical record system, so it’s not affecting the center’s ability to
care for patients.

Last month the FBI issued an alert about the Hive. The group is believed to
be responsible for a ransomware attack of Ohio’s Memorial Health System in
August, which affected more than 600,000 patients, according to the U.S.
Department of Health and Human Services Office of Civil Rights.

According to the FBI’s alert:

“Hive ransomware, which was first observed in June 2021 and likely operates
as an affiliate-based ransomware, employs a wide variety of tactics,
techniques, and procedures (TTPs), creating significant challenges for
defense and mitigation. Hive ransomware uses multiple mechanisms to
compromise business networks, including phishing emails with malicious
attachments to gain access and Remote Desktop Protocol (RDP) to move
laterally once on the network.

“After compromising a victim network, Hive ransomware actors exfiltrate
data and encrypt files on the network. The actors leave a ransom note in
each affected directory within a victim’s system, which provides
instructions on how to purchase the decryption software. The ransom note
also threatens to leak exfiltrated victim data on the Tor site,
‘HiveLeaks.’”

The alert also outlines how victims should respond to this type of attack.
The FBI encourages victims to report when they have been attacked but does
not recommend paying the ransom.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20210922/5d8a0e0b/attachment.html>