Russian Ransomware spreading gang CLOP has released some sensitive medical documents onto the dark web as its victim failed to pay a ransom of $3 million. The leaked records include phone numbers, house addresses, medical history, names and insurance details of several patients from law firms and local councils who visited GP practices & NHS hospital Trust in the past two years.
Highly placed sources say that the victim is a Britain-based data storage firm named Stor-A-File who offers services to securely store patient data to healthcare based companies.
Cybersecurity Insiders has learnt that the files dumped onto the dark web include sensitive details about women who underwent an abortion at clinics run by the Marie Stopes and British Pregnancy Advisory Service.
Interestingly, Clop ransomware gang also got their hands on the scanned images of foetuses that could be used by some cyber crooks for extortion purposes later.
Clop, also known with the name of Fancycat released an update early today stating that it can release more such information related to patients suffering from anorexia, addiction and erectile issues, if the data storage provider doesn’t pay attention to their demands.
The highlight is that some data related to the Ministry of Defense belonging to military officers working in Kuwait was also accessed by hackers in the attack on Stor-A-File.
ICO has taken a note of the cyber incident and assured that it will release an update as soon as a detailed investigation gets completed from its side.
National Crime Agency and NCSC have been pressed into service to investigate the incident guestimate its impact on the public in near future.
Note- In September first week, Stor-A-File was targeted by a file encrypting malware attack that locked down its servers from access by hackers demanding $4 million ransom in bitcoins. After negotiations, the threat actors’ group slashed $1 million from the demanded ransom. Then, as the staff of the firm stopped negotiating with them on the request of the law enforcement agencies, CLOP hackers leaked the stolen details to further threaten and embarrass the victim.
