Target Sector: Healthcare & Public Health
Court filings, technical advisories, and SEC Form 8-K enforcement disclosures documenting cyber intrusions against organizations in Healthcare & Public Health.
Key Facts
- 19 documented prosecution and advisory matters targeting Healthcare & Public Health.
- Cumulative reported financial losses exceed $22.8 billion.
- 5 of 19 cases reached conviction, guilty plea, or final sentencing.
- Tracked actors include Sandworm Team, LockBit Ransomware Group, ALPHV / BlackCat, FIN7.
Documented Incidents (19)
U.S. v. Andrienko et al. (Sandworm / GRU Unit 74455)
Six Russian Main Intelligence Directorate (GRU) military officers charged with deploying the NotPetya wiper, Olympic Destroyer malware, KillDisk attacks against Ukrainian power grids, and cyberattacks targeting French elections.
U.S. v. Khoroshev et al. (LockBit Ransomware Operation)
Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
ALPHV / BlackCat Ransomware Attack on Change Healthcare
Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.
U.S. v. Hladyr, Kolpakov & Iarmak (FIN7 Cybercrime Syndicate)
Prosecution of senior leaders of the FIN7 transnational cybercrime syndicate who hacked into thousands of computer systems across the United States, stealing more than 20 million customer credit card records from restaurants and hospitality chains.
U.S. v. Park Jin Hyok (Lazarus Group / Chosun Expo)
Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.
U.S. v. Vachon-Desjardins (Netwalker Ransomware)
Affiliate of Netwalker ransomware responsible for attacking dozens of healthcare systems, universities, and businesses during the COVID-19 pandemic, extorting tens of millions of dollars.
U.S. v. Roman Seleznev (Track2 Point-of-Sale Carding)
Prolific cybercriminal (Track2) who hacked into more than 500 small businesses and restaurants across the United States, stealing millions of credit card numbers and generating tens of millions of dollars in illicit sales on automated carding portals.
U.S. v. Alla Witte & Vladimir Dunaev (Trickbot Malware Group)
Key software developers and coders of the transnational Trickbot cybercrime group charged with infecting millions of victim computers with banking trojans and facilitating Conti/Ryuk ransomware deployments against hospitals.
U.S. v. Aleksandr Sikerin & Yevgeniy Polyanin (REvil Operations)
International enforcement action against REvil ransomware money exchangers and operators, recovering $6.1 million in ransomware proceeds extorted from businesses and local governments across the United States.
MGM Resorts Cyberattack (Scattered Spider / ALPHV Vishing Ingress)
Sophisticated social engineering and ransomware attack carried out by cybercrime collective Scattered Spider partnering with ALPHV/BlackCat, utilizing a 10-minute phone call to the Okta IT helpdesk to bypass MFA, hijack administrative privileges, and paralyze hotel reservations, digital keys, and casino slot machines.
WannaCry Global Self-Propagating Ransomware Worm
Global automated ransomware worm that weaponized the leaked NSA EternalBlue exploit (MS17-010) to self-propagate across 200,000 Windows computers in over 150 countries within hours, paralyzing 80 National Health Service (NHS) hospital trusts in the UK.
MOVEit Transfer Mass Zero-Day Extortion Campaign
Mass cyber extortion campaign exploiting a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software MOVEit Transfer appliances, exfiltrating personal records of over 90 million individuals across 2,700 organizations without encrypting files.
U.S. v. Fujie Wang et al. (Anthem 78.8M Patient Record Breach)
Chinese state-affiliated threat actors conducted spearphishing campaigns against Anthem health insurance subsidiaries, deploying customized backdoors to penetrate enterprise data warehouses and exfiltrate 78.8 million personal health and identity records.
Marriott Starwood 383 Million Guest Reservation Breach
State-sponsored cyber espionage operators maintained undetected access to the Starwood guest reservation database for four years, deploying remote access trojans and memory scrapers to exfiltrate unencrypted passport numbers, payment cards, and travel itineraries.
Ascension Health Network Black Basta Ransomware Outage
Severe ransomware incident paralyzing Ascension Health, one of the nation largest nonprofit Catholic hospital systems across 140 facilities in 14 states, forcing clinical staff to paper medical charts, diverting emergency trauma patients, and triggering CISA joint advisories on Russian-linked Black Basta operations.
Caesars Entertainment Scattered Spider Extortion ($15M Ransom)
Sophisticated vishing and social engineering intrusion by the Scattered Spider syndicate targeting an outsourced IT helpdesk servicing Caesars Entertainment, culminating in loyalty database exfiltration and approximately $15 million in cryptocurrency extortion paid to avert public release, disclosed in SEC Form 8-K Item 1.05.
Operation Dawnbreaker (Hive Ransomware Syndicate Takedown)
Coordinated multinational law enforcement action led by the FBI and DOJ that penetrated Hive ransomware network infrastructure for seven months, secretly capturing decryption keys to liberate over 1,300 victims worldwide and preventing $130 million in extortive ransom payments before seizing servers.
International Sanctions on Aleksandr Ermakov (Medibank Breach)
First joint cyber sanctions package deployed cooperatively by Australia, the United States, and the United Kingdom against Russian national Aleksandr Ermakov for orchestrating the catastrophic 2022 Medibank Private breach, stealing and weaponizing medical files of 9.7 million patients on dark web leak channels after extortion was refused.
U.S. v. FIN8 Conspirators (Badhatch Hospitality POS Malware)
Federal criminal indictment and investigative findings documenting financially motivated threat syndicate FIN8, which deployed Badhatch and Sardonic backdoors into point-of-sale memory across nationwide hotel and restaurant chains, scraping hundreds of thousands of customer payment cards.