Rhysida Ransomware Strikes Unimed Vales do Taquari e Rio Pardo
Incident Date:
May 8, 2024
Overview
Title
Rhysida Ransomware Strikes Unimed Vales do Taquari e Rio Pardo
Victim
Unimed Vales do Taquari e Rio Pardo
Attacker
Rhysida
Location
First Reported
May 8, 2024
Ransomware Attack on Unimed Vales do Taquari e Rio Pardo by Rhysida
Victim Profile
Unimed Vales do Taquari e Rio Pardo, the largest healthcare cooperative in the world, operates in the healthcare industry, particularly in the region of Lajeado, Rio Grande do Sul. The company offers medical services, health insurance, and other healthcare-related services in the Vales do Taquari and Rio Pardo regions.
Ransomware Attack Details
The cybercriminal group Rhysida targeted the Unimed Vales do Taquari e Rio Pardo website in Brazil with ransomware. They demanded 11 BTC (approximately $675,000) for decryption, threatening to expose sensitive data such as invoices, credit cards, and personally identifiable information. A sample of the leaked data was made available, and the ransom deadline was set for May 15, 2024.
Ransomware Group Profile
The Rhysida Ransomware Group, a new player in the cybercrime arena, targets various sectors, including healthcare, education, manufacturing, information technology, and government. They employ a double extortion technique, stealing data before encrypting it and threatening to publish it on the dark web unless a ransom is paid.
Company Vulnerabilities
Unimed Vales do Taquari e Rio Pardo's significant presence in the healthcare industry and the sensitive nature of the data they handle make them a prime target for threat actors like Rhysida. The company's size and revenue information are not explicitly provided, but being a prominent healthcare cooperative, they likely possess valuable data that cybercriminals seek to exploit.
Attack Methodology
Rhysida ransomware is deployed through diverse methods, including phishing campaigns. The group leverages valid credentials and network connections for initial access, with the exact method of obtaining these credentials still being determined. Once inside a victim's network, Rhysida employs various tools and techniques for lateral movement and data encryption.
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.