Gang warns it will publish HSE data unless ransom paid by Monday report

almost 3 years in The Irish Times

The ransom crime gang that has attacked the HSE has reportedly told the health service it will begin publishing the stolen data online, and selling it to other criminals, next Monday if the ransom is not paid.
The crime gang has demanded a ransom of $20 million to paid in bitcoin and threatened to publish or sell the information unless its demand was met. Both the HSE and Government has repeatedly stated publicly no ransom would be paid.
HSE chief executive Paul Reid said if the ransom was paid, the Irish authorities would be giving money to a crime gang attacking it that they could use to further strengthen their capabilities, repeating again no ransom would be paid.
According to a communication from the Russian-speaking cyber gang to the HSE that international news agency Bloomberg said it has seen, the gang has now fixed a deadline of next Monday, May 24th, for the ransom to be paid.
Redacted documents that were published on the darknet three days ago are believed to be some of those stolen during the attack. Gardaí believe they were shared publicly to continue increasing the pressure on the HSE to pay the ransom; a tactic ransom gangs use.
Garda sources said the initial publication of a small number of redacted documents was expected, based on similar attacks around the world. The same sources said they also expected full documents to be published, as has also been the case in other attacks. However, they made no comment on the new reported deadline of May 24th being applied by the gang.
Bloomberg has reported the latest messages to the HSE from the gang stated they “will start to sell and publish your data” next Monday. Previously they had said they would do so “very soon”.
The gangs that use the Conti malicious software – known as malware or ransomware – like that used against the HSE issues statements about its attacks on a blog on the darknet. They also use the same blog, or news site, to publish the documents and other data stolen from its victims. However, there are no references to date on the blog to the HSE.
Some of the redacted documents related to patients based in the Munster area and include forms that contain all of the patients’ personal details, information about their medical history and the medical professionals treating them.
Other documents appear to be commercial in nature, and relate to contracts between the HSE and some of the suppliers and other partners it works with.

Mentioned in this news
Share it on