Rhysida ransomware group claims major cyber attack on Prospect Medical Holdings's network

The infamous Rhysida ransomware group listed US healthcare network Prospect Medical Holdings as a victim on its data leak site and gave the institution nine days to pay a ransom to recover stolen data records.

Prospect Medical Holdings is one of the largest hospital networks in the U.S. with 16 hospitals under its wing operating in California, Connecticut, Pennsylvania, and Rhode Island and a network of 166 outpatient clinics and centres.

Earlier this month, Prospect Medical Holdings suffered a significant cyber attack that impacted several hospitals across the country. The news of a cyber attack came to light when the internal systems of the hospital’s network started facing technical issues, forcing the hospitals to divert patients to other facilities and to put a temporary halt to operations.  

In a statement shared with the media, a Prospect Medical Holdings’ spokesperson confirmed the cyber attack, stating that the hospital chain suffered a “data security incident that has disrupted our operations.”

“Upon learning of this, we took our systems offline to protect them and launched an investigation with the help of third-party cyber security specialists. While our investigation continues, we are focused on addressing the pressing needs of our patients as we work diligently to return to normal operations as quickly as possible,” the spokesperson added.

The notorious Rhysida ransomware gang recently claimed responsibility for the cyber attack on the hospitals’ network and listed Prospect as a victim on its data leak site. The group claims to be in possession of sensitive personal data of more than half a million PMH patients and employees that includes social security numbers, passports, driver’s licenses, patient medical files, and legal and financial documents.  

“Introducing our new partners – Prospect Medical Holdings....If you are interested in our partner’s confidential documents, you will be able to purchase them too!!! Total 1TB unique files, as well as 1.3TB SQL database,” Rhysida posted.

“With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner!” the group added.

The  group also posted sample data that contained Social Security Numbers and passport copies to prove the authenticity of the data. The group has offered to sell the stolen data for a price of 50 Bitcoins and has set up a timer of 9 days from the date of the post, which expires on September 1.

At the time of writing, the official website of the hospital network says, “Prospect Medical Holdings, along with all Prospect Medical facilities, is experiencing a systemwide outage. We are working to resolve the issue as soon as possible and regret any inconvenience.”