Ransomware Group RansomHub Targets NRS Healthcare in Data Breach
Incident Date:
May 6, 2024
Overview
Title
Ransomware Group RansomHub Targets NRS Healthcare in Data Breach
Victim
NRS Healthcare
Attacker
Ransomhub
Location
First Reported
May 6, 2024
RansomHub Targets NRS Healthcare in Major Ransomware Attack
Company Profile
NRS Healthcare, a prominent UK-based provider of healthcare services, specializes in daily living aids, community equipment, telecare, wheelchair services, and clinical services primarily to the NHS and Local Authorities. With a registered office at Sherwood House, Cartwright Way, Forest Business Park, Bardon Hill, Coalville, Leicestershire, the company operates under the SIC code 96090, which includes "Other service activities not elsewhere classified".
As a significant entity in the healthcare sector, NRS Healthcare boasts a revenue of $127 million and maintains a workforce of 21 employees, positioning it as a leading provider in its field.
Details of the Ransomware Attack
The cybercriminal group RansomHub, which has recently emerged in the cyber threat landscape, has claimed responsibility for a ransomware attack on NRS Healthcare. The attack resulted in the exfiltration of approximately 578 GB of sensitive data, including over 600,000 private documents such as accounting records, HR data, financial reports, reception documents, and contracts.
RansomHub Group Profile
RansomHub operates as a Ransomware-as-a-Service (RaaS) model, with its roots believed to be in Russia. This group is known for its use of Golang in developing ransomware, a trend that aligns with some of the latest developments in ransomware technology. The group's operational model allows affiliates to keep 90% of the ransom, with the remaining 10% going to the main operators.
Vulnerabilities and Attack Vectors
The specific vulnerabilities that were exploited in the attack on NRS Healthcare have not been disclosed. However, healthcare organizations like NRS Healthcare are often targeted due to the critical nature of their services and the sensitive data they handle. The sector's need for immediate access to data and systems may pressure such organizations into paying ransoms quickly to restore services, making them attractive targets for ransomware groups.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.