AdvancedHEALTH Ransomware Claim Includes 2.3M Patient Data Lines

"DragonForce claims it stole 390 GB of data from AdvancedHEALTH, including 2.3 million lines of patient information and records tied to minors, according to cybersecurity firm DeXpose. AdvancedHEALTH has not confirmed the group's full claim, and the scope of any exposed data remains unverified."

"DragonForce paired its leak-site post with a deadline, threatening to publish "1,000 lines of patient data per day" until a payment was made or the countdown expired, according to DeXpose. The patient files appear to be the center of the extortion threat."

"The patient files appear to be the center of the extortion threat. International Cyber Digest put the dataset at almost 2 million unique patient records after deduplication across 179 patient files, with 83,162 minors included in that count. The claimed haul also reaches into business operations, with partner agreements, management documents, payroll records, and HR files listed among the materials."

"At least one affiliated clinic has notified patients of a breach, while class-action attorneys are seeking current and former patients and employees who believe their information may have been compromised. AdvancedHEALTH declined to comment, and there's no official confirmation of DragonForce's allegations."

DragonForce claims it exfiltrated 390GB from AdvancedHEALTH, including patient information and records tied to minors. The claim includes 2.3 million lines of patient data and a dataset estimated at nearly 2 million unique patient records after deduplication across 179 patient files, with 83,162 minors included. The alleged materials also cover business operations such as partner agreements, management documents, payroll records, and HR files, with eClinicalWorks artifacts and insurer carrier contracts referenced. AdvancedHEALTH has not confirmed the full scope of the allegations. At least one affiliated clinic notified patients, and class-action attorneys are seeking current and former patients and employees who may have been affected.

Read at TechRepublic