Ransomware Hits Healthcare Services Group Exposing Sensitive Data
Ransomware Attack on Healthcare Services Group by Underground Ransomware Group
Healthcare Services Group, Inc. (HCSG), a leading provider of essential support services in the healthcare sector, has recently fallen victim to a ransomware attack orchestrated by the Underground ransomware group. This incident highlights the vulnerabilities faced by organizations operating in critical sectors like healthcare, where data security is paramount.
About Healthcare Services Group
Founded in 1976, HCSG has established itself as a significant player in the healthcare services industry, specializing in housekeeping, laundry, dining, and nutritional services. With a workforce of approximately 35,000 employees across 48 states, the company supports over 5,000 accounts nationwide. HCSG's commitment to infection prevention and control, alongside its focus on enhancing operational efficiency, makes it a vital component of healthcare facilities' operations.
Details of the Attack
The Underground ransomware group claims to have breached HCSG's systems, exfiltrating 1.1 TB of sensitive data. The stolen information reportedly includes confidential documents such as agreements, contracts, financial and legal records, vendor and supplier details, stockholder documentation, tax and recruitment files, service proposals, and invoices. Particularly concerning is the compromise of extensive employee information, including passports, IDs, Social Security Numbers, and various tax and payroll forms.
Profile of the Underground Ransomware Group
The Underground ransomware group, associated with the RomCom cybercrime organization, has been active since July 2023. Known for targeting Windows systems, the group employs sophisticated tactics, including exploiting vulnerabilities like CVE-2023-36884 and using phishing emails. Their ransomware uses the 3DES algorithm for file encryption, and they are known for not appending file extensions, which distinguishes them from other ransomware variants.
Potential Vulnerabilities and Penetration Tactics
HCSG's extensive operations and reliance on digital systems for managing critical support services may have made it an attractive target for the Underground group. The attackers likely exploited vulnerabilities in HCSG's IT infrastructure, potentially through phishing or exploiting known software vulnerabilities. The breach underscores the importance of cybersecurity measures, especially in sectors handling sensitive data.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!