Westmead Hospital’s Crown Princess Mary Cancer Center Hit by Cyberattack, Hackers Threaten to Release Stolen Data

A major cancer treatment center in Sydney was embroiled in a cyberattack by hackers who threatened to release stolen data unless hospital administrators paid a $100,000 ransom.

It’s unclear when the cybercriminals broke into Crown Princess Mary Cancer Center, part of Westmead Hospital, but NSW health officials said they were alerted to the threat late Thursday afternoon.

“NSW Health is working with the Center to assess whether NSW Health data has been impacted,” a spokesperson said.

“The safety and security of all NSW Health Systems remains paramount and is continuously monitored and protected.

The group claiming to be behind the attacks calls itself Medusa and has been actively targeting organizations in Australia and New Zealand since early January 2023.

Hackers have become known for using ransomware to steal data from victims, encrypt it, and then threaten to publish it unless a bounty is paid.

In March of this year, the same group posted several gigabytes of data claiming to be highly sensitive information stolen. Minneapolis Public SchoolsMultiple U.S. news outlets have included allegations of sexual abuse by students and other teachers after the school district refused to pay them $1 million.

On Thursday, the group listed the Princess Mary Cancer Center, 26 kilometers west of Sydney, on a dedicated leak site under a countdown of about seven days left.

Below that were three options. Cancer treatment centers could pay $10,000 for more time to consider options, pay $100,000 to remove stolen data, or pay $100,000 to download data. rice field.

A screenshot of the dedicated leak site, dubbed the Medusa blog by the hackers, circulated on Twitter and was picked up by cyber threat analyst Brett Callow.

Cybersecurity firm CyberCX said Medusa was a “major threat” and was the second most active cyber extortion group in the Pacific earlier this year.

Analysts say the group is likely to be small and experienced.