News > Cyber-Attacks > Ransomware by Kevin WOod

Planned Parenthood Under Cyberattack: RansomHub Threatens to Leak Sensitive Data

 

Millions of records at risk

In a concerning escalation of cyberattacks against the healthcare sector, Planned Parenthood of Montana (PPMT) was targeted by the notorious ransomware group, RansomHub. The attack was discovered on August 28, 2024, but it wasn’t until September 4, 2024, that RansomHub publicly claimed responsibility. The group alleges it has stolen 93 GB of sensitive data and is threatening to leak it unless their ransom demands are met.

This attack marks the second time in recent years that Planned Parenthood has fallen victim to cybercriminals, following a similar breach in 2021 when their Los Angeles branch was compromised.

The Cyberattack and Discovery

Planned Parenthood, one of the largest providers of reproductive healthcare in the United States, provides crucial services such as birth control, cancer screenings, and abortion care to millions. On August 28, Planned Parenthood of Montana detected unusual activity in its IT systems and immediately initiated incident response protocols. Portions of their network were taken offline to prevent further damage while cybersecurity experts were called in to assist.

Martha Fuller, CEO and President of Planned Parenthood of Montana, made an official statement confirming the breach. She stated:
“We immediately implemented our incident response protocols, including taking portions of our network offline as a proactive security measure. We are grateful to our IT staff and cybersecurity partners, who are working tirelessly to secure our systems and investigate the full scope of this attack.”​

RansomHub’s Claims and Threats

RansomHub, a rapidly growing ransomware gang, added Planned Parenthood to its dark web leak site on September 4, 2024. The group claims to have stolen 93 GB of sensitive data, including administrative, financial, and potentially patient-related information. As evidence, they posted screenshots of confidential documents on their extortion portal.

The ransomware gang has given Planned Parenthood seven days to respond to their ransom demands, threatening to release the full dataset if their demands are not met. It is currently unclear whether the stolen data includes patient health information (PHI), though the mere possibility has raised serious privacy concerns.

Fuller responded to the data leak threat by stating:
“We are aware of RansomHub’s post and want to assure our community that we are taking this matter very seriously. We have reported this incident to federal law enforcement and will support their investigation.”​

Implications for Healthcare and Privacy

This cyberattack comes at a time when healthcare organizations have increasingly become targets for ransomware groups. In the aftermath of the attack, cybersecurity experts are warning of the significant risks posed by such breaches. Planned Parenthood’s services cover highly sensitive areas, including reproductive healthcare, making any data leak potentially devastating for patients.

Randy Watkins, CTO at Critical Start, emphasized the danger:
“Healthcare providers like Planned Parenthood store personally identifiable information (PII), medical records, and other confidential data that, if exposed, could have severe consequences for patients. The compromise of personal health information could lead to identity theft, fraud, or even public exposure of deeply personal healthcare choices.”​

Further complicating matters is the backdrop of the 2024 U.S. presidential election, where reproductive rights and healthcare access have become major political flashpoints. This attack, while not directly tied to the election, could fuel further political debates, especially if sensitive patient information related to abortion services is exposed.

RansomHub’s Rise in the Ransomware Ecosystem

RansomHub is no stranger to the ransomware landscape, having targeted over 210 organizations since its formation earlier this year. The group emerged from the ashes of the defunct AlphV and LockBit groups, gaining notoriety for its aggressive tactics and high-profile targets.

RansomHub operates on an affiliate model, where smaller hacking groups can use their infrastructure in exchange for a share of the ransom. This model has made RansomHub one of the fastest-growing ransomware threats in 2024. Ferhat Dikbiyik, Chief Research Officer at Black Kite, commented on the group’s rise:
“RansomHub’s aggressive tactics, including offering affiliates up to 90% of the ransom, have fueled its rapid growth. Healthcare, energy, and telecommunications are among the hardest-hit sectors, with Planned Parenthood being the latest victim in a disturbing trend.”​

The Healthcare Sector: A Prime Target for Cybercriminals

The healthcare sector remains one of the most vulnerable to cyberattacks, with ransomware gangs increasingly focusing on hospitals and medical organizations. These institutions rely on complex IT infrastructures that often include legacy systems, making them easier targets for exploitation.

Additionally, healthcare organizations face unique challenges when responding to cyberattacks. Randy Watkins explained the delicate balance healthcare providers must maintain:
“Healthcare systems operate under strict regulatory frameworks like HIPAA in the U.S., meaning breaches can lead to hefty fines and legal repercussions. At the same time, these organizations need to maintain operational accessibility for life-saving services, which can be hindered during a ransomware attack.”​(SC Media)

The Road Ahead: What Comes Next for Planned Parenthood

Planned Parenthood’s IT teams, in collaboration with federal law enforcement, are continuing to investigate the full scope of the breach. As of now, it is unclear whether Planned Parenthood will negotiate with RansomHub or attempt to recover their systems without paying the ransom.

The FBI and CISA have been notified of the breach, and cybersecurity experts are advising all healthcare organizations to review their security measures in light of this attack. Planned Parenthood’s swift action in taking parts of its network offline and working with cybersecurity professionals demonstrates the organization’s commitment to protecting its patients and stakeholders.

The investigation into the attack is ongoing, and Planned Parenthood is expected to provide further updates as more details emerge.

Conclusion

The attack on Planned Parenthood of Montana by RansomHub is yet another reminder of the escalating cyber threat landscape, particularly for healthcare organizations. With 93 GB of data potentially at risk, the attack could have far-reaching implications for patient privacy and the organization’s ability to deliver essential healthcare services.

As healthcare organizations continue to face mounting cyber threats, the need for robust security measures and rapid response protocols has never been greater. The coming days will be critical for Planned Parenthood as it works to secure its systems and prevent the release of sensitive data.