This week, Brazilian healthcare giant Grupo Fleury suffered a ransomware attack. Business operations were impaired up to the point that systems had to be shut down, leaving patients unable to book appointments for labs and other medical examinations online. On the 22nd of June, the Grupo Fleury website began displaying a warning message, alerting to the fact that its systems were suffering an attack, but that the company was doing its best to remediate the damage. The message also stated that “the causes of this unavailability originated from the attempted external attack on [their] systems, which are having operations re-established with all the resources and technical efforts for the rapid standardization of services.”
Since the disclosure, several cybersecurity sources have confirmed the attack was launched by the REvil ransomware gang, also known as Sodinokibi. “The Healthcare industry and healthcare supply chain are both one of the top three targeted sectors worldwide. Additionally, REvil are launching a lot of attacks at the moment, having hit a maritime organisation in Brazil earlier this month,” said Andy Norton, European cyber risk officer at Armis.
We are in the midst of watching ransomware gangs become more sophisticated and daring, often targeting companies just to prove a point. Following the ransomware on the healthcare provider, Robert Golladay, EMEA and APAC director at Illusive, believes that the fact that a ransomware gang has gained access to such sensitive information is concerning. “While it is not clear whether personal data was exfiltrated or not, it is best for Fleury to take all necessary steps to alert potentially affected parties and provide advice on how to best prepare for socially engineered scams”, Golladay said.
REvil is demanding $5 million for the decrypter key and the assurance that no vital information will be leaked online. The fact that Grupo Fleury contains massive amounts of personal and medical patient data, exacerbates its value and once again giving an example as to why healthcare facilities all over the world are being targeted. Norton states that “with a revenue of $500 million USD, the victim would also classify as “big game”, and therefore considered more likely to make a ransom payment.”
Commenting on the story, Niam Muldoon, global data protection officer at OneLogin says that “cybercrime is a business so all should think of it the same way. Out of all the various types of cybercrime activities ransomware is the one activity that has a high direct return of investment associated with it, by holding the victims ransom for financial payment. Taking the global economic environment and current market conditions into consideration cyber criminals will of course continue to focus on their efforts to this revenue generating stream.”
Ultimately, no organisations should consider themselves as safe from ransomware, especially not the healthcare sector. Cyber-criminals will not stop at a chance to exploit vulnerable and unprotected businesses for financial profit, which is why it is vital to have sufficient defences in place. Golladay suggests that “today’s threats make it essential to look for bad actors that might already be within the network, and this can be done by creating a hostile environment for an attacker and blocking lateral movement before critical systems are compromised.”
