Ransomware Group RansomHub Targets NRS Healthcare in Data Breach

Incident Date:

May 6, 2024

World map



Ransomware Group RansomHub Targets NRS Healthcare in Data Breach


NRS Healthcare




Leicestershire, United Kingdom

, United Kingdom

First Reported

May 6, 2024

RansomHub Targets NRS Healthcare in Major Ransomware Attack

Company Profile

NRS Healthcare, a prominent UK-based provider of healthcare services, specializes in daily living aids, community equipment, telecare, wheelchair services, and clinical services primarily to the NHS and Local Authorities. With a registered office at Sherwood House, Cartwright Way, Forest Business Park, Bardon Hill, Coalville, Leicestershire, the company operates under the SIC code 96090, which includes "Other service activities not elsewhere classified".

As a significant entity in the healthcare sector, NRS Healthcare boasts a revenue of $127 million and maintains a workforce of 21 employees, positioning it as a leading provider in its field.

Details of the Ransomware Attack

The cybercriminal group RansomHub, which has recently emerged in the cyber threat landscape, has claimed responsibility for a ransomware attack on NRS Healthcare. The attack resulted in the exfiltration of approximately 578 GB of sensitive data, including over 600,000 private documents such as accounting records, HR data, financial reports, reception documents, and contracts.

RansomHub Group Profile

RansomHub operates as a Ransomware-as-a-Service (RaaS) model, with its roots believed to be in Russia. This group is known for its use of Golang in developing ransomware, a trend that aligns with some of the latest developments in ransomware technology. The group's operational model allows affiliates to keep 90% of the ransom, with the remaining 10% going to the main operators.

Vulnerabilities and Attack Vectors

The specific vulnerabilities that were exploited in the attack on NRS Healthcare have not been disclosed. However, healthcare organizations like NRS Healthcare are often targeted due to the critical nature of their services and the sensitive data they handle. The sector's need for immediate access to data and systems may pressure such organizations into paying ransoms quickly to restore services, making them attractive targets for ransomware groups.


Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.