Tel Aviv-based Mayanei Hayeshua Medical Centre suffered a serious Ragnar Locker ransomware attack that enabled the ransomware group to steal data from its systems and release it on the dark web.

The Mayanei Hayeshua Medical Centre, a Tel Aviv-based hospital, reported in August that it suffered a significant cyber attack that forced it to redirect new patients to other healthcare centres.

According to local media agencies, patients who were already admitted in the hospital were getting proper care but all new and emergency patients were transferred to other medical centres. Mayanei Hayeshua Medical Center notified the Health Ministry and Israel National Cyber Directorate about the incident.

“The attack caused the hospital’s computer systems to fail. According to the information currently available, the medical equipment was not affected,” a spokesperson for the Directorate said.

“Hospital staff continue to provide treatment to patients. Health Ministry and National Cyber Directorate staff are currently at the hospital, working to manage the event in cooperation with the hospital staff. Additional updates will be provided later.”

The notorious Ragnar Locker ransomware group has now claimed responsibility for the cyber attack on the Israeli hospital and listed it as a victim on its data leak site. The group said that it is releasing the first batch of internal fines stolen from the hospital’s servers.

According to a local news outlet, the threat actors are in possession of around 1 terabyte of data stolen from the medical centre. The stolen data includes a full SQL database and a large volume of .pst files with internal correspondence. The compromised data may also include the sensitive personal and health information of top government officials, lawmakers, and senior rabbis.

“First of all, we want to emphasise that since this is a medical institution – we didn’t run any encryption to avoid equipment malfunctions, or necessary instruments,” the Ragnar Locker group said. “However, serious vulnerabilities allow us to download a lot of data and someone else in our place could use such a vulnerability in any other way.

“We tried to draw their attention to the network issues and called them for discussion. Instead of the dialogue, they decided to play tricks with us, they even tried to catch us with phishing. Come on guys, seriously? So, after multiple attempts to contact the management of MYMC, it becomes clear for us that management of MYMC doesn’t care about the privacy of its own patients, sad to state this fact but it’s true.

“Today we are posting the first batch of MYMC internal files, you can find among those a lot of personal information, internal emails, finances, medical cards and more of highly sensitive data.

“But this is not all, in next 3-4 days we will upload to public view full SQL database and huge bunch of .pst files with internal correspondence. Expect for the updates and keep your privacy in your own hands. According to our rules we are publishing the data which were compromised during security research of the MYMC network,” the group added.

The hospital is yet to share any statement regarding the ransomware group’s claim, but tweeted the following statement: “We have been busy at the hospital doing everything we need to do to be running as normal and protect all data.”