Saskatchewan Health Quality Council Hit by INC Ransom Ransomware Attack
Ransomware Attack on Saskatchewan Health Quality Council by INC Ransom
The Saskatchewan Health Quality Council (HQC), an independent organization established in 2002, has recently fallen victim to a ransomware attack by the notorious INC Ransom group. HQC, which operates in the healthcare services sector, is dedicated to enhancing the quality of health and healthcare services in Saskatchewan. The organization employs a multifaceted approach, focusing on quality improvement, research and analytics, collaboration, education, and public reporting.
About the Saskatchewan Health Quality Council
HQC is a pioneering entity in Canada, known for its commitment to continuous quality improvement within the healthcare system. The organization collaborates with various stakeholders, including health organizations, government bodies, and community groups, to drive initiatives that improve health outcomes. HQC's expertise in measurement and analytics allows it to provide independent, evidence-based assessments of healthcare programs and services. The organization also fosters strong partnerships with entities like the Saskatchewan Ministry of Health and the Saskatchewan Health Authority.
Details of the Ransomware Attack
INC Ransom, a sophisticated cybercriminal group, has claimed responsibility for the attack on HQC via their dark web leak site. The group is known for its targeted ransomware attacks on corporate and organizational networks, employing advanced techniques such as spear-phishing campaigns and exploiting vulnerabilities like CVE-2023-3519 in Citrix NetScaler. The attackers not only encrypt data but also steal it, threatening to release it publicly to increase pressure on victims to comply with ransom demands.
HQC, with a revenue of $6.2 million, now faces significant operational and data security challenges due to this breach. The attack underscores the vulnerabilities that even well-established organizations in the healthcare sector can face from sophisticated threat actors like INC Ransom.
About INC Ransom
INC Ransom has been active since 2023 and has targeted various industries, including healthcare, education, government entities, and technology companies. The group distinguishes itself through its use of double extortion tactics, where they not only encrypt the victim's data but also steal it and threaten to release it publicly. This approach increases the pressure on victims to pay the ransom. INC Ransom has previously claimed responsibility for breaching organizations such as Xerox Corp and NHS Scotland.
The group's ability to penetrate HQC's systems likely involved exploiting known vulnerabilities and using legitimate system tools for reconnaissance and lateral movement within the network. This incident highlights the evolving and sophisticated nature of cyber threats and the critical need for enhanced cybersecurity measures.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!