Ransomware Group RansomHub Targets NRS Healthcare in Data Breach
RansomHub Targets NRS Healthcare in Major Ransomware Attack
Company Profile
NRS Healthcare, a prominent UK-based provider of healthcare services, specializes in daily living aids, community equipment, telecare, wheelchair services, and clinical services primarily to the NHS and Local Authorities. With a registered office at Sherwood House, Cartwright Way, Forest Business Park, Bardon Hill, Coalville, Leicestershire, the company operates under the SIC code 96090, which includes "Other service activities not elsewhere classified".
As a significant entity in the healthcare sector, NRS Healthcare boasts a revenue of $127 million and maintains a workforce of 21 employees, positioning it as a leading provider in its field.
Details of the Ransomware Attack
The cybercriminal group RansomHub, which has recently emerged in the cyber threat landscape, has claimed responsibility for a ransomware attack on NRS Healthcare. The attack resulted in the exfiltration of approximately 578 GB of sensitive data, including over 600,000 private documents such as accounting records, HR data, financial reports, reception documents, and contracts.
RansomHub Group Profile
RansomHub operates as a Ransomware-as-a-Service (RaaS) model, with its roots believed to be in Russia. This group is known for its use of Golang in developing ransomware, a trend that aligns with some of the latest developments in ransomware technology. The group's operational model allows affiliates to keep 90% of the ransom, with the remaining 10% going to the main operators.
Vulnerabilities and Attack Vectors
The specific vulnerabilities that were exploited in the attack on NRS Healthcare have not been disclosed. However, healthcare organizations like NRS Healthcare are often targeted due to the critical nature of their services and the sensitive data they handle. The sector's need for immediate access to data and systems may pressure such organizations into paying ransoms quickly to restore services, making them attractive targets for ransomware groups.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!