Weeks after US healthcare network Kettering Health announced that it suffered a cyberattack, ransomware group Interlock has claimed responsibility for the attack. Kettering was left dealing with a system outage due to the attack, confirmed it had been targeted, but didn’t reveal additional information at the time.
While the healthcare firm didn’t reveal who was behind the attack, CNN reported that it was Interlock. The group was reported to be threatening Kettering to release stolen information if a ransom wasn’t paid. It seems that any ongoing negotiations between the hackers and the firm have broken down as Interlock has finally claimed the attack on Kettering and listed them on their leak site, according to BleepingComputer.
The cybercriminals claim they have stolen 941 GB of data from the healthcare organisation, including 20,000 folders and 732,489 documents containing sensitive information, including:
- Bank reports
- Payroll information
- Patient data
- Pharmacy and blood bank documents
- Kettering Health police personnel files
- Scans of identity documents, including passports
Shortly after the attack, Kettering had also warned patients of scam calls from individuals impersonating the company and looking to take advantage of the situation by tricking patients into giving up credit card information. While the scam and ransomware attack can be two separate incidents, if Interlock ends up selling this information to the wrong people, these scam calls will be the least of Kettering’s patients’ worries.
Interlock is a relatively new ransomware group that came up in September 2024, already having claimed dozens of victims around the world. The group usually targets healthcare organisations, which are becoming an increasingly beneficial target for similar cybercrime groups due to their fast-paced nature and reliance on computer systems. Additionally, hospitals and healthcare organisations often have highly sensitive data stored on thousands of patients at once, so even if they refuse the ransom payment, the ransomware operators still have a good chance to make money by selling the stolen data.
In the News: Online grocery shop KiranaPro hacked; AWS and GitHub code wiped
