2 Clinics Notify 700,000 Patients of Alleged BianLian Hacks

Two medical practices – one in North Carolina and the other in Florida – are notifying a total of more than 700,000 patients whose health and other sensitive information was stolen in separate hacking incidents earlier this year. The now-dormant ransomware gang BianLian on its dark website had claimed both organizations among its victims earlier this year.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

Goshen Medical Center, a federally qualified community health center with 38 medical care sites in Eastern North Carolina, reported its hack on Sept. 17 to federal and state regulators, including Maine’s attorney general, saying its incident affected nearly 456,400 people.

Meanwhile, Melbourne, Florida-based Medical Associates of Brevard, which has six family medicine and specialty healthcare locations in the region, told federal regulators on Sept. 5 that its hack affected nearly 247,000 people.

Cybercrime gang BianLian listed both organizations as victims on its dark website – Goshen in March and MAB in January.

Neither MAB nor Goshen Medical immediately responded to Information Security Media Group’s requests for additional details about their respective hacks, including comment on BianLian’s claims.

BianLian Gone Dark

Security monitoring website Ransomware.live counts 553 BianLian victims since the group first appeared around July 2022. Security researchers said BianLian’s most recent victim was discovered in late March. Around that time, the FBI warned corporate executives to be on the lookout for potentially fraudulent snail mail letters claiming that the “BianLian Group” has stolen sensitive corporate data.

Letter writers demanded a payment of between $250,000 and $500,000 within 10 days. But whoever was behind the letters, the FBI said the extortionists were apparently not associated with the actual Russia-based BianLian ransomware operation (see: Breach Roundup: US Sanctions Iran-Based Nemesis Admin).

“BianLian hasn’t claimed any new victims on their data leak site since March 31. We have not observed any new attacks attributed to this group since,” said Grayson North, principal threat intelligence consultant at security firm GuidePoint Security.

“Notably, this inactivity started a few weeks after we reported on the ‘snail mail’ ransomware campaign in which imposters used the group’s name. While the evidence is circumstantial, we assess that the BianLian group felt that this campaign created negative sentiment towards their name and damaged their reputation,” he said.

“Reputation is extremely important to ransomware groups, as extortion payments rely on some degree of trust that they will follow through on their promises. We find it likely that the actors behind BianLian ‘rebranded’ their operation and continue to operate under a different name to ensure the negative reporting does not affect their bottom line,” he said.

Nonetheless, as of Monday, there is no conclusive evidence of where these actors are currently operating, he said. “Sometimes, new threat groups can be linked to their predecessors via similarities in tactics and codebases, but no such conclusions have yet been drawn by our team or the cybersecurity community.”

Goshen Medical Center Hack

Goshen in its breach notice said that on March 4, it detected suspicious activity within its IT network.

The medical provider’s investigation into the incident with third-party cybersecurity specialists determined that certain Goshen files may have been accessed or acquired without authorization on Feb. 15.

“We then undertook a comprehensive review of the affected data and, on or about Sept. 12, learned that some personal health information was involved,” Goshen said, adding that so far it has “no evidence of the misuse or attempted misuse of any potentially impacted information.”

Potentially compromised information includes name, address, date of birth, Social Security number, driver’s license number and medical record number, Goshen said.

Since the incident, Goshen said it has implemented additional measures to reduce the risk of a similar incident occurring in the future.

Goshen is offering affected individuals 12 months of complimentary credit and identity monitoring.

Medical Associates of Brevard Breach

MAB in its breach notice said it was subject to a “criminal cyberattack” that affected its systems. The healthcare provider did not specify when the incident was detected.

MAB’s investigation with third-party cybersecurity experts determined that the hackers accessed or acquired individuals’ protected health information and personally identifiable information.

That breached information potentially includes names, dates of birth, Social Security numbers, driver’s license numbers, state ID numbers, medical treatment information, health insurance information, and, for a limited number of individuals, financial account information.

MAB is offering affected individuals 12 months of complimentary identity and credit monitoring.

Prime Targets

North said that while BianLian appears dormant, GuidePoint Security is still seeing healthcare organizations “getting hit by plenty of groups in the space.”

According to the firm’s data, from the start of the year through the end of August, 300 healthcare victims have been publicly claimed by ransomware groups, North said.

So far this year, healthcare is the fourth most impacted industry behind manufacturing – 625 victims, technology – 412 victims and ‘retail and wholesale,’ with 348 victims, he said.

Among ransomware groups affecting healthcare victims, INC Ransom is the most prolific at the moment with 42 such victims so far, North said. INC is followed closely by Qilin which has claimed 40 victims in the healthcare sector.

“INC and Qilin are both very active in the space currently. Qilin operates in a ransomware-as-a-service model, where disparate affiliates conduct attacks opportunistically with very few rules on acceptable versus unacceptable victims,” he said.

INC, Qilin and other groups that regularly target the healthcare sector are likely attracted to the leverage gained by stealing personal health data. “We have done multiple negotiations with ransomware actors on behalf of healthcare organizations where the actor tries to appeal to the victim’s ethics, with threat actors trying to convince victims that they have a duty to pay ransoms to protect their patients’ confidentiality,” he said.

GuidePoint is seeing “tremendous” amounts of attacks which begin with the threat actor logging into a valid account through the victim’s VPN, he said.

“This typically results from a forgotten service account or an admin with a weak password, combined with misconfigured or nonexistent multifactor authentication policies,” he said.

North said the firm is also continuing to see threat actors target VPN and other edge devices through unpatched vulnerabilities. “Threat actors are focusing on this vector at the moment because these appliances, by design, must be accessible via the internet. Once compromised, these appliances give threat actors an instant foothold on the victim’s network,” he said.

Defenders must ensure that a strong MFA solution is in place and enforced on every single VPN login – without exception, North stressed. “In addition, organizations should enforce complex password policies on VPN accessible accounts. Finally, defenders should act swiftly to patch any reported vulnerabilities on edge devices such as VPNs, firewalls, etc.”