Incident
incident:medical_provider_patient_record_extortion
The 2017 compromise of a medical provider in Montevideo in which patient records were taken and fifteen Bitcoin were demanded to prevent disclosure.
The 2017 compromise of a medical provider in Montevideo in which patient records were taken and fifteen Bitcoin were demanded to prevent disclosure.
“the hacker sent a ransom e-mail to the medical providers showing they had confidential data and demanded they pay fifteen Bitcoin”
“The hacker sent an e-mail to the medical provider demanding fifteen Bitcoins or they’d release the patient data they collected.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | medical provider | Explicit | 25 |
| outgoing | INITIAL_ACCESS_VIA | website compromise | Explicit | 25 |
| outgoing | INVOLVES | Data exfiltration | Explicit | 25 |
| outgoing | INVOLVES | extortion | Explicit | 25 |
| outgoing | ATTRIBUTED_TO | Alberto Hill | Attributed | 25 |
| incoming | SAME_AS | Operation Bitcoins | Explicit | 25 |
medical-provider patient-record extortion COMPROMISES medical provider
The incident involved an attacker breaking into the medical provider's website, accessing its database, and taking patient records.
Explicit Confidence 99% · Jack Rhysider EP 25 Details
“The hacker broke in through the provider’s website, accessed the database and took a ton of patient records.”
medical-provider patient-record extortion INITIAL_ACCESS_VIA website compromise
The attacker initially gained access through the medical provider's website.
Explicit Confidence 99% · Jack Rhysider EP 25 Details
“The hacker broke in through the provider’s website”
medical-provider patient-record extortion INVOLVES Data exfiltration
The attacker accessed the database and took patient records.
Explicit Confidence 99% · Jack Rhysider EP 25 Details
“accessed the database and took a ton of patient records”
medical-provider patient-record extortion INVOLVES extortion
The attacker demanded Bitcoin and threatened to release confidential patient information, including details about people with HIV and cancer.
Explicit Confidence 99% · Jack Rhysider EP 25 Details
“sent a ransom e-mail to the medical providers showing they had confidential data and demanded they pay fifteen Bitcoin”
Operation Bitcoins SAME_AS medical-provider patient-record extortion
Jack says the police called the medical-provider extortion case Operation Bitcoins.
Explicit Confidence 96% · Jack Rhysider EP 25 Details
“They contacted the police who called this case Operation Bitcoins.”
medical-provider patient-record extortion ATTRIBUTED_TO Alberto Hill
Uruguayan police and the courts attributed the medical-provider hack and extortion to Alberto, but Alberto repeatedly denied doing it and Jack questions whether the wrong person was convicted.
Attributed Confidence 93% · Jack Rhysider EP 25 Details
“Alberto was found guilty and he was being sent to a long-term prison”
“I did not do it. I didn’t do it and I am innocent.”
“which is probably why in the end they caught the wrong guy”