BianLian Claims Credit for 2 Health Data Hacks

Cybercriminal gang BianLian claims to have stolen patient information in two recent hacks of an Alabama-based ophthalmology practice and a California dental clinic. The two incidents affected nearly 150,000 people and are among the extortion group’s latest attacks on the healthcare sector.

See Also: A Modern Approach to Data Security

Alabama Ophthalmology Associates reported its breach to the U.S. Department of Health and Human Services on April 8 as a hacking incident involving a network server and desktop computer affecting nearly 132,000 people.

The Alabama practice is also already facing at least one proposed federal class action lawsuit filed in recent weeks in the wake of the hack.

In the second alleged BianLian data heist, San Mateo, Calif.-based Sonrisas Dental Health reported a breach to HHS’ Office for Civil Rights on May 2 as a hacking incident involving a network server and affecting nearly 16,000 people.

BianLian as of Monday listed both entities on its darkweb leak site as recent victims.

Alabama Hack

AOA in its breach notice said the incident affected current and former patients.

AOA on Jan. 30, said it became aware of unusual activity within its network environment. “Upon discovery, AOA took steps to secure its network and engaged a leading, independent digital forensics and incident response firm to investigate what happened and whether any sensitive data may have been impacted,” the ophthalmology practice said.

The investigation found that an “unknown actor” accessed and acquired some information between Jan. 22 and Jan. 30. The review of the affected data was completed on March 19 determining potentially affected information may have included individuals’ names, dates of birth, Social Security numbers, health insurance information, treatment information, medical record number and medical history information.

Not all data elements were affected for all individuals.

Dental Practice Breach

Sonrisas in its breach notice said that it learned of “a cyber extortion incident” that may have affected data of certain employees and patients. The practice on March 4 became aware of unusual activity in its digital environment, the notice said. Upon identifying this activity, the clinic said it promptly took steps to secure its digital environment and investigate.

“As a result of this investigation, on March 14, we learned that an unauthorized actor potentially acquired certain files and data within our systems.” While the review is ongoing and compromised information varies upon individual, potentially affected are names, driver’s license number, Social Security number, date of birth and dental image information.

Sonrisas said it has no evidence that any information potentially involved in the incident has been misused.

Neither AOA nor Sonrisas immediately responded to Information Security Media Group’s requests for additional detail about their respective incidents and for comment on BianLian’s darkweb claims.

BianLian Attacks

BianLian has been the subject of government advisories, including one joint alert last November by the FBI, the Cybersecurity Infrastructure and Security Agency and the Australian Signals Directorate’s Australian Cybersecurity Center (see: Feds Warn of New BianLian Ransomware Group Attack Profile).

The advisory warned that the group – which had earlier shifted from using double extortion strategies to primarily data theft – had appeared to be trying to confuse investigators’ attempts to attribute the gang’s attacks – a trick that some other ransomware groups have also tried.

More recently, in March, the FBI issued an advisory about a scam involving letters delivered by postal mail from unidentified criminal actors to corporate executives, claiming to have come from ransomware group BianLian.

“BianLian is among the most active ransomware groups currently targeting the healthcare sector,” said Christiaan Beek, senior director of threat analytics at security firm Rapid7, which also issued a report about the development.

“The actors behind BianLian are unknown; however, they are mostly targeting U.S. victims and the majority of the intelligence scene attributes them to a Russia-based group,” Beek said.

Compared to other ransomware gangs like LockBit or Royal, BianLian stands out for its focused strategy of data theft and extortion without encryption, particularly targeting hospitals and medical organizations where disruption and data sensitivity create high pressure to pay, he said.

“While LockBit remains the most prolific overall, BianLian’s shift to pure extortion and its consistent targeting of healthcare puts it in the top tier of threats to the sector,” he said. “It operates more quietly and surgically than larger ransomware-as-a-service groups; for example, the group does not post frequently to its leak site.”

As for the fake letters being mailed to supposed BianLian victims, that tactic is unusual, Beek said.

“Sending physical letters is a very uncommon thing. In the past, we have seen ransomware that sent a ransom note to print out on the victim’s printers, but I can’t say as we’ve seen physically mailed letters like this before,” he said.

“The motive is always to make money, and although it is a very weird move to send physical letters with a QR code, I must admit it’s creative.”