Care Health

Prioritize Healthy life

Gang leaks Lehigh Valley Health Network cancer patient photos as part of data hack

Gang leaks Lehigh Valley Health Network cancer patient photos as part of data hack

A ransomware gang has posted photos of Lehigh Valley Health Network cancer patients on the dark web after the health network refused to pay a ransom last month following a cyberattack.

“This unconscionable criminal act takes advantage of patients receiving cancer treatment, and LVHN condemns this despicable behavior,” the network said in a prepared statement.

ALPHV, also known as BlackCat, is associated with Russia and known for similar cyberattacks in academia and healthcare sectors. The group posted a message Saturday night saying it had stolen patient data including nude photos, passports, and questionnaires, and was ready to publish it.

LVHN said the stolen information includes three screenshots, which are clinically appropriate photographs of cancer patients receiving radiation oncology treatment at LVPG Delta Medix, as well as seven documents containing patient information.

“Our blog is followed by a lot of world media, the case will be widely publicized, and will cause significant damage to your business. Your time is running out. We are ready to unleash our full power on you,” ALPHV’s posted message read.

LVHN released a statement last month on the ransomware attack, saying it involved information and patient images for radiation oncology treatment from a single physician practice in Lackawanna County.

LVHN found unauthorized activity on its IT system Feb. 6, and notified law enforcement, LVHN President and CEO Brian A. Nester said Feb. 20.

BlackCat demanded a ransom payment, which LVHN refused to pay. The U.S. Department of Health and Human services said in a warning in January that BlackCat has demanded ransoms as high as $1.5 million.

LVHN is still investigating and said it is in the process of identifying information involved in the incident. The healthcare network said it believes the attack was focused on the Delta Medix IT system and has had very limited impact on other LVHN IT systems.

“We will provide notices as required to those whose information was involved,” the statement said.

LVHN includes 13 hospital campuses; 28 health centers; 20 ExpressCARE locations, and numerous physician practices, pharmacy, imaging, home health, rehabilitation and lab services.