Ransomware Strikes Masonic Care Tasmania Exposing Data Risks
Incident Date:
September 30, 2024
Overview
Title
Ransomware Strikes Masonic Care Tasmania Exposing Data Risks
Victim
Masonic Care Tasmania (MCTas)
Attacker
3AM
Location
First Reported
September 30, 2024
Ransomware Attack on Masonic Care Tasmania: A Closer Look
Masonic Care Tasmania (MCTas), a prominent not-for-profit organization providing aged care services across Tasmania, has recently fallen victim to a ransomware attack by the ThreeAM group. This incident highlights the vulnerabilities faced by organizations in the healthcare sector, particularly those with extensive digital operations.
About Masonic Care Tasmania
Established over 60 years ago, MCTas is dedicated to enhancing the quality of life for seniors through a comprehensive range of aged care services. The organization operates several facilities, including Derwent Views and Tamar Valley Court, offering residential aged care, retirement living, and home care services. MCTas employs approximately 580 staff members, emphasizing compassionate care and community engagement. The organization's commitment to holistic support and community connections makes it a vital player in Tasmania's aged care sector.
Details of the Ransomware Attack
The attack was discovered on October 1, with ThreeAM claiming responsibility on their dark web leak site. The group has reportedly uploaded 15 .rar files containing stolen data, totaling over 198 gigabytes. The compromised data includes sensitive information such as passports, credit reports, résumés, medical certificates, and emails. The breach underscores the potential risks faced by organizations handling large volumes of personal data.
About the ThreeAM Ransomware Group
ThreeAM is a relatively new player in the ransomware landscape, known for targeting sectors with critical data, such as healthcare. The group employs sophisticated techniques to infiltrate systems, often leveraging phishing campaigns and exploiting vulnerabilities in network security. Their strategy involves exfiltrating data before encryption, threatening to publish it unless a ransom is paid. This double extortion tactic is a hallmark of modern ransomware operations.
Potential Vulnerabilities and Penetration Methods
Organizations like MCTas, which handle sensitive personal data, are attractive targets for ransomware groups. The attack on MCTas may have been facilitated by vulnerabilities in their digital infrastructure, such as outdated software or insufficient network security measures. The healthcare sector's reliance on digital systems for managing patient information makes it particularly susceptible to such attacks.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.