Lagatar24 Desk
Chennai, Dec 3: Hackers sold the personal information of 1.5 lakh Sree Saran Medical Center patients on well-known cybercrime forums and a Telegram channel where databases were for sale. CloudSEK, a company that foresees cyber threats, found the data leak.
Patient information from 2007 to 2011 is included in the sensitive material, which was obtained via a hacked third-party vendor named Three Cube IT Lab. But according to CloudSEK, there is no evidence that Three Cube is acting as a software supplier for Sree Saran Medical Center.
The hackers provided a sample as evidence so that prospective buyers could verify the accuracy of the data. Names of the patients, birth dates, addresses, guardians’ names, and medical information are all part of the disclosed data.
The healthcare company whose data was included in the sample was located by CloudSEK’s researchers using the names of the doctors in the database. They were able to determine that the doctors are employed by Tamil Nadu’s Sree Saran Medical Center.
The patients’ information was for sale online for $100, which implied that numerous copies of the database would be sold. The cost was increased to USD 300 for individuals who wanted to buy the database alone. The quoted fee for anyone who wanted to resell the database was USD 400.
CloudSEK has informed the stakeholders about the data breach. “We can term this incident as a Supply Chain Attack, since the IT Vendor of the Hospital, in this case, Three Cube IT Lab, was targeted first. Using access to the vendor’s systems as an initial foothold, the threat actor was able to exfiltrate Personally identifiable information (PII) and Protected Health Information (PHI) of their hospital clients,” Noel Varghese, a threat analyst at CloudSEK said.
This comes just a day after a cyberattack on the All India Institute of Medical Sciences (AIIMS) in Delhi compromised where the personal information of millions of patients.
