A major cancer treatment centre in Sydney has been caught up in a cyber attack with hackers threatening to release stolen data unless hospital administrators pay a ransom of $100,000.
Key points:
- NSW health officials said they were alerted to the threat late on Thursday afternoon
- The group Medusa claims to be behind the attack
- Analysts say Medusa is the second-most active cyber extortion group in the Pacific
It is unclear when cyber criminals managed to breach the Crown Princess Mary Cancer Centre, which is part of Westmead Hospital, but NSW health officials said they were alerted to the threat late on Thursday afternoon.
“NSW Health is working with the centre to assess if any NSW Health data has been impacted,” a spokesperson said.
“The safety and security of all NSW Health systems remains of highest importance and is continually monitored and safeguarded,” they said.
The group claiming to be behind the attack calls itself Medusa and has been actively targeting organisations in Australia and New Zealand since the start of January 2023.
The hackers have become known for using ransomware to steal data from their victims before encrypting it and then threatening to publish it unless a bounty is paid.
In March this year the same group posted gigabytes of what it claimed to be highly sensitive information stolen from Minneapolis Public Schools, including allegations of sexual abuse by students and other teachers, after the district refused to pay $US1 million, according to multiple US news outlets.
On Thursday the group listed the Crown Princess Mary Cancer Centre, which is 26 kilometres west of Sydney, on its dedicated leak site below a countdown time with about seven days remaining.
Beneath that were three options — the cancer treatment centre could pay $10,000 to give itself more time to consider its options, pay $100,000 to delete the stolen data or pay $100,000 to download the data.
Screenshots of the dedicated leak site, which the hackers called Medusa blog, were circulated on Twitter and were picked up by cyber threat analyst Brett Callow.
CyberCX, a cyber security company, said that Medusa posed a “high threat” and earlier this year was the second-most active cyber extortion group in the Pacific.
Analysts say the group is likely to be small and experienced.