Connecting the Dots – What the Ransomware Headlines Are Missing – Ep 574 

Ransomware used to sound like a fairly straightforward nightmare: attackers get in, encrypt your files, demand money, and ruin everyone’s week. Unfortunately, the business model has gotten an upgrade. Today’s ransomware groups are stealing massive amounts of data, recruiting affiliates with surprisingly competitive revenue splits, disabling security tools, contacting patients directly, and even hijacking social media accounts to turn up the pressure. Meanwhile, regulators are asking harder questions about risk analysis and looking further into the past for answers. Connect those dots, and the picture gets uncomfortable fast. This episode explores what recent ransomware headlines are really telling healthcare organizations, including the small ones still hoping they’re too tiny to attract attention. Spoiler alert: the bad guys appear to have misplaced their minimum-size requirement.

In this episode:

Connecting the Dots: What the Ransomware Headlines Are Missing – Ep 574

Today’s Episode is brought to you by:

Kardon

and

HIPAA for MSPs with Security First IT

 Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity. 

Great idea! Share Help Me With HIPAA with one person this week!

Learn more about Kardon Club and HIPAA for MSPs!

Thanks to our donors. We appreciate your support!

If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com

Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA

Episode Roadmap

Connecting the Dots: What the Ransomware Headlines Are Missing

• Several separate stories appeared within the same few weeks.
• OCR ransomware settlement.
• AnMed operational disruption and escalating extortion.
• CRPx0 targeting healthcare organizations.
• BlackFog Q2 ransomware findings.
• Viewed together, they tell a much larger story than any individual headline.

The latest big OCR settlement announced

OSF Healthcare System Resolution Agreement and Corrective Action Plan | HHS.gov

“An accurate and thorough HIPAA risk analysis is not only required by law, but it is also necessary

to protect health information and prevent or mitigate ransomware attacks,” said OCR Director

Paula M. Stannard. “If a HIPAA regulated entity doesn’t know what threats and vulnerabilities exist

to its electronic protected health information (ePHI), they will often learn the hard way when their

systems are hacked.”

• OCR announcement released July 29, 2026.
• OCR’s 21st ransomware enforcement action.
• Underlying ransomware incident discovered April 23, 2021. The settlement was announced five years after the original incident. There’s another example of the marathon these incidents turn into when you have big ones.
• OSF later determined that PHI belonging to 53,907 individuals had been stolen.
• OCR’s investigation identified potential failures involving:
  • Accurate and thorough risk analysis.
  • Impermissible disclosure of PHI.
  • Timely notification to affected individuals.
  • Timely notification to HHS.

Settlement terms

• $552,250 resolution amount.
• Two-year corrective action plan monitored by OCR.
• Normal SRA and reporting requirements we have been seeing in the CAP

Important point:

• OCR is not looking for a ceremonial risk-analysis document.
• It expects a repeatable process supported by evidence.

In other news along these lines

We’ve started helping a client who got a notification about an investigation recently and everyone involved, attorneys and us, was surprised to see them ask for six years of risk analysis documentation. We’ve seen plenty that asked for two, maybe three, but never all six. That should be a clue what they’re focusing on as they ramp up the changes to the security rule. It’s going to be about risk analysis

Big ransomware incident happening in healthcare right now

AnMed given 72 hours to respond to demands in ransomware incident | Healthcare IT News

‘The Gentlemen’ ransomware gang takes over hospital Facebook after cyberattack

AnMed hit with data theft claim after Facebook hack

• Cybersecurity incident identified July 26.
• Malware disrupted systems across South Carolina and Georgia.
• System-wide effects included:
  • Network access.
  • Internet access.
  • Phone service.
  • Patient portal access.
  • Imaging.
  • Laboratory services.
  • Scheduling.
  • Elective procedures.
  • Oncology and radiation services.
• Most AnMed locations were initially affected or temporarily closed.
• Downtime procedures activated.
• Emergency departments and some other services remained operational.
• Clinical decisions involving procedures, transfers, diversions, and operations made around patient safety.
• Patients advised to bring medications and printed lab orders.
• Temporary telephone and communication processes established.

The Gentlemen Ransomware Group

The Gentlemen Ransomware Group Is Scaling Faster Than Any Other Group on Record

Threat intelligence briefing: The Gentlemen Ransomware

“Operating primarily as a highly aggressive Ransomware-as-a-Service (RaaS), the group distinguishes itself through an unprecedented 90/10 affiliate revenue split, aggressive recruitment campaigns, lasting affiliate loyalty and the distribution of an advanced, centralized endpoint detection and response (EDR) killer suite known as GentleKiller.”

“The group offers a 90/10 revenue split (compared to the industry standard 80/20). This highly lucrative model has triggered a mass migration of top-tier affiliates from competing RaaS programs.”

“Established an official partnership with the BreachForums marketplace to recruit penetration testers and initial access brokers (IABs).”

The recovery timeline

• Ten facilities remained closed as of August 10, 15 days after the incident began.
• Forensic investigation continued.
• Full restoration timeline remained uncertain.
• Patient-data involvement had not been confirmed.
• AnMed warned patients to be cautious with electronic communications appearing to originate from the organization.
• Systems and services gradually restored:
  • Phone service.
  • Read and write access to medical records.
  • Partial MyChart access.
  • Additional verification added for portal access.
• Recovery was underway, but the incident was not finished.

The AnMed story escalates

• August 11:
  • Unauthorized posts appeared on AnMed’s social media accounts.
  • Posts appeared on its Facebook page for approximately 30 minutes.
  • AnMed removed the content.
  • Access to the platform was disabled while the accounts were secured.
• The unauthorized message:
  • Displayed imagery associated with The Gentlemen ransomware group.
  • Claimed six terabytes of AnMed corporate and patient data had been exfiltrated.
  • Claimed possession of highly sensitive clinical and personal information.
  • Said the data would be deleted upon payment.
• Claimed information included records involving:
  • HIV status.
  • Suicide registries.
  • Sexual assault and rape.
  • Mental health.
  • Abortions.
  • Genetic information.
  • Social Security numbers and dates of birth.
  • Autopsy and police evidence.
• The Gentlemen also reportedly added AnMed to its dark-web leak site.
• AnMed response:
  • Unauthorized posts confirmed.
  • Claims not verified.
  • Claims remain under investigation.
  • Notifications will be made if the investigation confirms personal information was affected.
• No public evidence supplied by the attackers to verify the six-terabyte claim or the claimed contents.

More of this is probably happening than we know

• The recent Black Fog report told us that 97% of ransomware incidents they reviewed for their Q2 report involved data exfiltration, the highest rate ever recorded
• Healthcare was the most targeted sector, accounting for 81 attacks (26%)
• While they believe 87 percent of identified attacks are undisclosed at least they say healthcare leads in disclosures.

Don’t think small ones matter

CRPxO Ransomware Group Profile | SOCRadar

Healthcare IT News article on AnMed mentioned CRPx0 as another active double-extortion group affecting healthcare organizations.

When you connect all these ransomware dots, the picture isn’t exactly something you’d hang on the refrigerator. Attackers are stealing data at record rates, developing ways to neutralize security tools, recruiting more affiliates, and deliberately targeting smaller healthcare organizations that may have fewer defenses. At the same time, regulators are making it increasingly clear that “we thought we were covered” isn’t much of a security strategy. A thorough risk analysis helps you understand what you’re protecting, where it lives, what threatens it, and whether your safeguards actually work. Because the goal isn’t to predict which ransomware group will come knocking. It’s to make sure that when someone does, one deadbolt isn’t the only thing standing between them and the jewelry box.

Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!

Special thanks to our sponsors Security First IT and Kardon.