UK healthcare large HCRG confirms hack after ransomware gang claims theft of delicate knowledge
U.Ok. healthcare large HCRG Care Group has confirmed it’s investigating a cybersecurity incident after a ransomware gang claimed to have breached the corporate’s techniques to steal troves of delicate knowledge.
HCRG Care Group is among the largest impartial suppliers of group well being and care providers in the UK. The group, beforehand generally known as Virgin Care and now owned by Twenty20 Capita, companions with Nationwide Well being Service trusts and native authorities across the U.Ok. to ship healthcare providers, together with pressing care, sexual well being, and grownup and youngster social care providers.
HCRG was this week listed on the darkish internet leak web site of the prolific Medusa ransomware group, which claims to have compromised the corporate to steal greater than two terabytes of knowledge.
Samples of the allegedly stolen knowledge shared by Medusa and seen by TechCrunch seem to incorporate staff’ private data, delicate medical information, monetary information, and authorities identification paperwork, comparable to passports and beginning certificates.
HCRG spokesperson Alison Klabacher instructed TechCrunch in an emailed assertion that the corporate is “at the moment investigating an IT safety incident” and has “lately recognized a submit on the darkish internet by a bunch claiming duty.”
The corporate declined to say what sorts of knowledge had been accessed however didn’t dispute Medusa’s claims. HCRG additionally declined to say what number of people are affected. In line with the corporate’s web site, HCRG has greater than 5,000 staff and delivers healthcare providers to half 1,000,000 sufferers throughout the UK.
“Our workforce has not noticed any suspicious exercise for the reason that implementation of instant containment measures, and we’re working with exterior forensic specialists to analyze the incident, the spokesperson mentioned.
HCRG mentioned it knowledgeable the U.Ok.’s Data Commissioner’s Workplace and different regulators concerning the breach.
“Our providers are persevering with to function and safely see sufferers, and people with appointments or who have to entry our providers ought to proceed to take action,” the corporate mentioned.
The Medusa ransomware group is threatening to publish the allegedly stolen knowledge until HCRG pays the gang a ransom demand of $2 million.
HCRG wouldn’t affirm the way it was compromised, however Medusa is thought to take advantage of unpatched vulnerabilities in distant desktop software program.
