A ransomware gang is auctioning off Social Security numbers, passport information and health data from more than 500,000 patients and employees of Culver City, Calif.-based Prospect Medical Holdings, CyberNews reported Aug. 24.
The Rhysida group posted on the dark web Aug. 24 that it would be selling the data in the next seven days for 50 bitcoins, currently the equivalent of about $1.3 million, according to the story. The information also allegedly includes driver's licenses and "financial and legal documents."
"Introducing our new partners — Prospect Medical Holdings....If you are interested in our partner's confidential documents, you will be able to purchase them too!!! Total 1TB unique files, as well as 1.3TB SQL database,” the gang reportedly wrote. "With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner!"
Prospect Medical fell victim to a ransomware attack Aug. 3, forcing its hospitals in multiple states to switch to paper records and suspend services. The next day, HHS warned that a new ransomware group, Rhysida, was targeting healthcare.
"Prospect Medical continues to work around the clock to recover critical systems and restore their integrity. We are making significant progress. Some operational systems have been fully restored and we are in the process of bringing others online," the 16-hospital system said in a statement to Becker's. "We also launched an investigation with the help of third-party cybersecurity specialists and are working closely with law enforcement. Due to the sensitivity of the incident and law enforcement involvement, we are unable to provide additional information at this time."