Integris Health patients in Oklahoma are receiving extortion emails stating that data was stolen during a cyberattack on the healthcare network and that, if they do not pay a ransom demand, the data will be sold to other threat actors.
See also: Toronto Public Library (TPL): Various services offline due to cyberattack
Integris Health is the largest nonprofit health network in Oklahoma, with hospitals, clinics, and urgent care facilities throughout the state.
The health network confirmed that they suffered a cyberattack in November that led to the theft of personal patient data.
“ INTEGRIS Health has detected possible unauthorized activity on certain systems ,” a data protection notice on the Integris Health website states
On December 24, through blackmail emails sent to patients, hackers claim to have stolen the personal data of more than 2 million patients in the cyberattack on Integris Health.
This data allegedly includes Social Security Numbers, dates of birth, addresses, telephone numbers, insurance information, and employer information.
The threatening message sent to Integris patients states: “We have contacted Integris Health, but they refuse to resolve this issue.”
The emails include a link to a threat website via Tor, which states that the data of approximately 4,674,000 people, including their names, ID numbers, dates of birth and information about hospital visits, has been stolen.
The website includes data added from October 19 to December 24, 2023, allowing visitors to pay $50 to delete the data or $3 to view it.
BleepingComputer has found that the site has around 4,674,000 data records. However, it is unclear whether there are any duplicates.
Integris Health is aware of the emails sent to patients and has updated its security notice to warn recipients not to respond, contact the sender, or click on any of the links in the email.
While the perpetrator of the attack against Integris Health is unknown, similar emails were sent to patients at Fred Hutchinson Cancer Center (Fred Hutch) after the Hunters International ransomware group infiltrated the hospital.
See also: Akumin: Medical institution rejects patients after cyberattack
Fred Hutch emails also allowed patients to visit a dark website and delete their data by paying $50, making it possible that the same ransomware has been carried out against Integris Health.
As attackers can use the exposed data to conduct identity theft, some patients may be tempted to pay to have the data deleted.
However, as previous extortion demands have shown, paying the ransom does not always lead to the actual deletion of data.
Additionally, after paying a ransom, hackers know you are interested in the data and may try to blackmail you further.
A blackmail email often contains threats or promises of negative consequences if the sender's instructions are not followed. This may include the threat of publishing sensitive information or the threat of a digital attack. Blackmail emails often ask for payment, usually through anonymous methods such as Bitcoin. This is an important sign to look out for.
Spelling errors and poor grammar are often present in these emails. This is because many extortionists use automated tools to send mass emails. Another important sign is that the email may appear to come from a reputable organization or individual, but the sender's email address does not match the organization's official address.
See also: General Electric: Investigating allegations of cyberattack and data leak
Finally, blackmail emails often contain attached files or links that may contain malware. You should be very careful and not open such files or links.
Source: bleepingcomputer
