Virginia Urology Silent on Possible Data Breach as Purported Patient Data Begins to Leak

Virginia Urology, a seven-site practice in Richmond, Virginia, remains silent about a possible data breach after threat actors calling themselves MS13-089 claimed they hacked the organisation on 9 November and exfiltrated 927 GB of data. DataBreaches[.]net notes that the attackers’ dark web leak site shows a file tree and that a sample of data was shared with DataBreaches, including copies of faxed referrals and reports with PHI exposed in plain text.

The spokesperson told DataBreaches that they did not encrypt the data “so as not to harm the patients,” and claimed they are the developers of the MS-13 virus “a name taken from Microsoft security bulletin MS13-098,” while stating they are not terrorists and have no connection to Mara Salvatrucha. DataBreaches[.]net observed that filenames often incorporated patients’ first names, last names, and dates of birth, indicating PHI exposure. The firm has not confirmed or denied a breach and has not responded to DataBreaches’ inquiries, according to the article.