Hive ransomware group claims to steal California health plan patient data

The Hive ransomware team, identified for attacking healthcare companies, posted on its darkweb internet site that it has stolen 850,000 individually identifiable information (PII) documents from the Partnership HealthPlan of California.

The organization’s website at this time is made up of a landing webpage that claims the wellbeing approach has been “experiencing complex issues,” including a “disruption to particular pc techniques.” The organization’s cellphone devices have a related message, with a recorded concept saying that “all of our units are down, with no anticipated time of repair.”

“We are operating diligently with third-occasion specialists to investigate the source of this disruption, affirm its impression on our devices, and to restore full performance to our programs as soon as feasible,” the health plan explained in the concept on its web page, which is not dated.

The Partnership HealthPlan of California claims it has set up Gmail addresses for people and providers to contact. VentureBeat has emailed the tackle for basic inquiries.

Brett Callow, a danger analyst at cybersecurity organization Emsisoft, mentioned in a concept to VentureBeat that “establishing alternative interaction channels is a common play in incident response.”

“Even if your e mail technique is functioning, the attackers could have entry and be capable to keep an eye on communications,” Callow claimed.

The complex troubles seem to have started various days ago. The Push Democrat claimed on the challenges on March 24, with out mention of a cyberattack, and indicated that the health program has more than 618,000 users in Northern California.

The Hive ransomware group posted its declare about the stolen Partnership HealthPlan of California data on Tuesday. The data includes 850,000 distinctive PII documents, these types of as identify, social protection selection and address, in accordance to the team. The stolen info also consists of 400 GB of stolen information from the organization’s server, Hive claimed.

The ransomware team has been lively given that at the very least June 2021, which is the initial time the group posted on its “HiveLeaks” darkweb web page.

Earlier claimed ransomware attacks by Hive have provided an August 2021 attack towards Memorial Health Procedure, which has hospitals in Ohio and West Virginia, and an October 2021 assault in opposition to Johnson Memorial Wellness in Indiana.

A preceding alert from the FBI warned that the Hive ransomware team “likely operates as an affiliate-based mostly ransomware, employs a extensive variety of methods, approaches, and treatments (TTPs), making considerable challenges for protection and mitigation.”

“Hive ransomware utilizes many mechanisms to compromise organization networks, including phishing email messages with malicious attachments to gain entry and Remote Desktop Protocol (RDP) to shift laterally after on the community,” the FBI stated. “After compromising a victim network, Hive ransomware actors exfiltrate information and encrypt files on the network. The actors depart a ransom observe in just about every affected listing within just a victim’s process, which presents guidance on how to order the decryption program. The ransom take note also threatens to leak exfiltrated target facts on the Tor web site, ‘HiveLeaks.’”