Planned Parenthood of Montana confirms cyberattack

A prolific ransomware operation claims to have stolen 93 gigabytes of data.

Planned Parenthood of Montana confirmed Wednesday that it was targeted in a late-August “cybersecurity incident” and that it is investigating the matter. 

The statement from Planned Parenthood of Montana CEO & President Martha Fuller said the organization identified the incident Aug. 28 and “immediately implemented our incident response protocols, including taking portions of our network offline as a proactive security measure.” 

The statement came after RansomHub, a prolific ransomware group, listed the nonprofit on its website Wednesday. The listing, which included screenshots of documents the attackers said came from within Planned Parenthood, claimed that 93 gigabytes of data was stolen. The attackers have given Planned Parenthood until Sept. 11 to pay an undisclosed ransom or have the material published.

The sample material so far does not seem to include private patient data. The incident occurred eight days after Montana’s secretary of state certified that a coalition of abortion rights groups had collected enough valid signatures to ensure a vote on adding a right to abortion to the state’s constitution in this November’s election.

“We are aware of the RansomHub post,” Fuller said, “and want to assure our community that we are taking this matter very seriously. We have reported this incident to federal law enforcement, and will support their investigation.”

The organization is investigating “the cause and scope of the incident,” Fuller said. 

Since emerging online Feb. 10,  RansomHub has posted roughly 232 observed targets on its page, according to data collected by eCrime.ch, an online cybercrime research platform. The group operates as a ransomware-as-a-service operation, where affiliates use the platform and ransomware variant to carry out the attacks and split extortion proceeds with a core group of developers. 

The Cybersecurity and Infrastructure Security Agency said in an Aug. 29 advisory that RansomHub has “established itself as an efficient and successful service model” and has encrypted and exfiltrated data from at least 210 victims since February.

RansomHub has been tied to major incidents in its relatively brief run, most recently as the rumored variant used in an attack and data exfiltration that targeted the energy services titan Halliburton, which the company said it detected Aug. 21. Halliburton has not confirmed that RansomHub was involved.

RansomHub was also the platform used in a second extortion attempt in April targeting UnitedHealth Group’s subsidiary Change Healthcare. Attackers originally working with the now-defunct ALPHV ransomware platform took stolen Change Healthcare data to RansomHub after ALPHV’s administrators scammed affiliates out of their portion of a $22 million ransom payment ALPHV received from UnitedHealth Group. 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure