RansomHub Ransomware Attack Exposes 100GB of We Level Up Data

Incident Date: Jul 30, 2024

Attack Overview
VICTIM
We Level Up
INDUSTRY
Healthcare Services
LOCATION
USA
ATTACKER
Ransomhub
FIRST REPORTED
July 30, 2024

RansomHub Claims Ransomware Attack on We Level Up Treatment Centers

We Level Up, a prominent network of treatment centers specializing in mental health and addiction recovery, has reportedly fallen victim to a ransomware attack orchestrated by the RansomHub group. The cybercriminals claim to have exfiltrated 100 GB of sensitive data from the organization, setting a ransom deadline for August 6th to avoid potential data exposure or further consequences.

About We Level Up

We Level Up operates a network of treatment centers across the United States, focusing on comprehensive care for individuals struggling with substance abuse and mental health issues. The organization offers a range of services, including medical detoxification, addiction treatment, dual-diagnosis treatment, and family and alumni programs. Their facilities are known for high-quality care, a low patient-to-therapist ratio, and serene environments conducive to healing. The organization emphasizes personalized treatment plans tailored to meet the unique needs of each patient, which is crucial for addressing the complexities of addiction and mental health disorders.

Attack Overview

The ransomware attack on We Level Up was claimed by RansomHub via their dark web leak site. The attackers allege that they have exfiltrated 100 GB of sensitive data from the organization. The ransom deadline has been set for August 6th, by which the organization must comply to avoid potential data exposure or further consequences. The exact nature of the data exfiltrated has not been disclosed, but it is likely to include sensitive patient information given the nature of We Level Up's services.

About RansomHub

RansomHub is a relatively new ransomware group that has emerged in the cyber threat landscape. The group is believed to have roots in Russia and operates as a Ransomware-as-a-Service (RaaS) group, with affiliates receiving 90% of the ransom money and the remaining 10% going to the main group. RansomHub distinguishes itself by making claims and backing them up with data leaks. Their ransomware strains are written in Golang, a language choice that is becoming increasingly popular among ransomware developers.

Potential Vulnerabilities

Healthcare organizations like We Level Up are particularly vulnerable to ransomware attacks due to the sensitive nature of the data they handle. The integration of various treatment programs and the need for comprehensive patient records make these organizations attractive targets for cybercriminals. The attack on We Level Up underscores the importance of cybersecurity measures in the healthcare sector to protect against such threats.

Sources

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.