Saskatchewan Health Quality Council Hit by INC Ransom Ransomware Attack
Incident Date:
August 24, 2024
Overview
Title
Saskatchewan Health Quality Council Hit by INC Ransom Ransomware Attack
Victim
Saskatchewan Health Quality Council
Attacker
Inc Ransom
Location
First Reported
August 24, 2024
Ransomware Attack on Saskatchewan Health Quality Council by INC Ransom
The Saskatchewan Health Quality Council (HQC), an independent organization established in 2002, has recently fallen victim to a ransomware attack by the notorious INC Ransom group. HQC, which operates in the healthcare services sector, is dedicated to enhancing the quality of health and healthcare services in Saskatchewan. The organization employs a multifaceted approach, focusing on quality improvement, research and analytics, collaboration, education, and public reporting.
About the Saskatchewan Health Quality Council
HQC is a pioneering entity in Canada, known for its commitment to continuous quality improvement within the healthcare system. The organization collaborates with various stakeholders, including health organizations, government bodies, and community groups, to drive initiatives that improve health outcomes. HQC's expertise in measurement and analytics allows it to provide independent, evidence-based assessments of healthcare programs and services. The organization also fosters strong partnerships with entities like the Saskatchewan Ministry of Health and the Saskatchewan Health Authority.
Details of the Ransomware Attack
INC Ransom, a sophisticated cybercriminal group, has claimed responsibility for the attack on HQC via their dark web leak site. The group is known for its targeted ransomware attacks on corporate and organizational networks, employing advanced techniques such as spear-phishing campaigns and exploiting vulnerabilities like CVE-2023-3519 in Citrix NetScaler. The attackers not only encrypt data but also steal it, threatening to release it publicly to increase pressure on victims to comply with ransom demands.
HQC, with a revenue of $6.2 million, now faces significant operational and data security challenges due to this breach. The attack underscores the vulnerabilities that even well-established organizations in the healthcare sector can face from sophisticated threat actors like INC Ransom.
About INC Ransom
INC Ransom has been active since 2023 and has targeted various industries, including healthcare, education, government entities, and technology companies. The group distinguishes itself through its use of double extortion tactics, where they not only encrypt the victim's data but also steal it and threaten to release it publicly. This approach increases the pressure on victims to pay the ransom. INC Ransom has previously claimed responsibility for breaching organizations such as Xerox Corp and NHS Scotland.
The group's ability to penetrate HQC's systems likely involved exploiting known vulnerabilities and using legitimate system tools for reconnaissance and lateral movement within the network. This incident highlights the evolving and sophisticated nature of cyber threats and the critical need for enhanced cybersecurity measures.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.