Hive ransomware group claims to steal California well being plan affected person knowledge

The Hive ransomware group, identified for attacking healthcare organizations, posted on its darkweb website that it has stolen 850,000 personally identifiable info (PII) data from the Partnership HealthPlan of California.

The group’s web site presently consists of a touchdown web page that claims the well being plan has been “experiencing technical difficulties,” together with a “disruption to sure laptop methods.” The group’s telephone methods have an identical message, with a recorded message saying that “all of our methods are down, with no anticipated time of restore.”

“We’re working diligently with third-party specialists to research the supply of this disruption, verify its influence on our methods, and to revive full performance to our methods as quickly as doable,” the well being plan stated within the message on its web site, which isn’t dated.

The Partnership HealthPlan of California says it has arrange Gmail addresses for sufferers and suppliers to contact. VentureBeat has emailed the handle for normal inquiries.

Brett Callow, a risk analyst at cybersecurity agency Emsisoft, stated in a message to VentureBeat that “establishing various communication channels is an ordinary play in incident response.”

“Even when your electronic mail system is working, the attackers might have entry and have the ability to monitor communications,” Callow stated.

The technical points seem to have begun a number of days in the past. The Press Democrat reported on the problems on March 24, with out point out of a cyberattack, and indicated that the well being plan has greater than 618,000 members in Northern California.

The Hive ransomware group posted its declare in regards to the stolen Partnership HealthPlan of California knowledge on Tuesday. The information consists of 850,000 distinctive PII data, reminiscent of title, social safety quantity and handle, in accordance with the group. The stolen knowledge additionally consists of 400 GB of stolen information from the group’s server, Hive claimed.

The ransomware group has been energetic since a minimum of June 2021, which is the primary time the group posted on its “HiveLeaks” darkweb website.

Previous reported ransomware assaults by Hive have included an August 2021 assault towards Memorial Well being System, which has hospitals in Ohio and West Virginia, and an October 2021 assault towards Johnson Memorial Well being in Indiana.

A earlier alert from the FBI warned that the Hive ransomware group “probably operates as an affiliate-based ransomware, employs all kinds of techniques, strategies, and procedures (TTPs), creating important challenges for protection and mitigation.”

“Hive ransomware makes use of a number of mechanisms to compromise enterprise networks, together with phishing emails with malicious attachments to achieve entry and Distant Desktop Protocol (RDP) to maneuver laterally as soon as on the community,” the FBI stated. “After compromising a sufferer community, Hive ransomware actors exfiltrate knowledge and encrypt information on the community. The actors depart a ransom be aware in every affected listing inside a sufferer’s system, which supplies directions on learn how to buy the decryption software program. The ransom be aware additionally threatens to leak exfiltrated sufferer knowledge on the Tor website, ‘HiveLeaks.’”