ALPHV ransomware gang targets Melbourne pathology firm TissuPath

The notorious ALPHV ransomware gang, also known as BlackCat, has launched a cyberattack on a Melbourne-based pathology firm, TissuPath, gaining access to detailed patient records by exploiting third-party supplier login credentials.

 

The breach was initially detected on August 24th when the threat actors, operating under the ominous shadow of cybercrime, contacted TissuPath with a chilling ultimatum: unless a ransom payment was made, they would publicly release sensitive patient information within 48 hours.

 

Prompted by this alarming threat, an immediate investigation was launched, leading to the confirmation of the breach by TissuPath. In response, the company swiftly activated its cybersecurity contingency plan.

 

Although TissuPath’s official incident report refrains from explicitly naming the threat actor, threat intelligence platform Falcon Feeds has identified ALPHV as the culprit behind this sinister intrusion. Interestingly, ALPHV’s TOR leak site is offline, possibly in response to heightened scrutiny.

 

Patient data compromised in the breach encompasses a range of sensitive information, including names, dates of birth, gender, and contact details, including phone numbers and addresses, if provided by the patients. Additionally, Medicare and health insurance numbers and details of the referring physicians for each patient have been exposed.

 

TissuPath confirmed that no billing information was compromised, as it is not stored on the affected systems. However, the precise number of impacted patients has not been disclosed, though the exposed data pertains to referrals made between 2011 and 2020.

 

TissuPath emphasized the critical nature of the affected data, stating, "The TissuPath Pathology specimens and referrals are for suspected cancer patients. Such data is retained for 20 years and reported per National Pathology Accreditation Advisory Council (NPAAC) specifications."

 

The breach’s entry point was a third-party supplier whose storage drives were accessed due to a vulnerability in their remote access toolkit (RAT). Exploiting this opening, the threat actors gained access to admin accounts within TissuPath’s network.

 

TissuPath promptly reported the security incident as a notifiable data breach to the Office of the Australian Information Commissioner and the Australian Cyber Security Centre. The firm is actively collaborating with Australian Cyber Security Centre representatives to mitigate the fallout from this breach.