Hunters International ransomware gang claims to have hacked the Fred Hutch Cancer Center

The Hunters International ransomware gang claims to have hacked the Fred Hutchinson Cancer Center (Fred Hutch).

Another healthcare organization suffered a ransomware attack, the Hunters International ransomware gang claims to have hacked the Fred Hutchinson Cancer Center (Fred Hutch).

The ransomware gang has added the organization to its dark web leak site and is threatening the victim to leak the alleged stolen data.

Fred Hutchinson Cancer Research Center is an independent, nonprofit research institute based in Seattle, Washington. Its mission is to improve the lives of people worldwide through research, clinical care and education.

The center’s research focuses on cancer prevention, diagnosis, treatment and survivorship. Fred Hutch investigators are making groundbreaking discoveries in cancer genomics, immunotherapy, precision medicine and other fields.

The organization operates a network of clinical sites in the US.

Earlier in December, Fred Hutch disclosed a cyber attack that took place on November 19, 2023. Threat actors had access to its infrastructure.

The Seattle Times reported that Fred Hutch patients started receiving email threats following cyberattack.

“Then this week, the spam emails started to arrive. The threats were sent to a number of former and current Fred Hutch patients — as well as some who have received care from Hutch partner UW Medicine — and claimed the names, Social Security numbers, phone numbers, medical history, lab results and insurance history of more than 800,000 patients had been compromised.” reported the Seattle Times.

“If you are reading this, your data has been stolen and will soon be sold to various data brokers and black markets to be used in fraud and other criminal activities,” the alleged hackers wrote, according to several emails shared with The Seattle Times.”

The organization immediately started the incident response procedure, it took impacted systems offline, a circumstance that suggests that Fred Hutch was the victim of a ransomware attack.

The company notified federal law enforcement and launched an investigation into the incident with the help of a leading forensic firm.

In a notice of security incident published on its website, Fred Hutch pointed out that all clinics are open and actively serving patients.

“Fred Hutchinson Cancer Center recently detected unauthorized activity on limited parts of our clinical network. We immediately notified federal law enforcement and engaged a leading forensic security firm to investigate and contain the incident. All Fred Hutch clinics are open and actively serving patients.” reads the notice. “The safety, wellbeing, and personal information of our patients and employees is of the utmost importance to Fred Hutch. Our forensic team is continuing to conduct an assessment of the data accessed and we will provide further updates as we have them.”

The company implemented additional information technology security measures and deployed additional defensive tools and increased monitoring activities.

The ransomware group initially claimed to have exfiltrated 533.1GB of data from the company and published thumbnails of some alleged stolen documents. However the time of this writing the gang has removed Fred Hutch from the leak site, did the company pay the ransom?

Who is Hunters International?

The ransomware group emerged in the threat landscape after international authorities seized the Hive gang’s infrastructure. Hunters International is suspected to be a sort of rebrand of the Hive ransomware gang.

Experts noticed that the Hunters International group is using a code that is very similar to the one used by the Hive gang.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)