A  Sydney-based cancer treatment institution, Crown Princess Mary Cancer Centre suffered a cyber attack that involved threat actors stealing thousands of files containing sensitive information.

Crown Princess Mary Cancer Centre provides research, prevention, diagnostic treatment and rehabilitation programs for patients and families coping with cancer.

Recently, the notorious Medusa ransomware gang targeted the cancer treatment facility and listed it as a victim on its data leak site. The threat actors claimed to be in possession of thousands of files containing sensitive information stolen from the hospital.

On May 4, the group added the hospital on its data leak site and demanded a ransom of $100,000. Medusa gave a deadline of seven days to pay the ransom and threatened to publish the stolen data if the ransom isn’t paid within the given deadline.

Medusa has given the institution the option of extending the deadline by 24 hours by making a payment of $10,000 or to download and/or get the stolen data deleted by paying $100,000.

While the cancer treatment centre did not provide much details about the cyber attack, New South Wales authorities are investigating the security incident. According to local media, the authorities claimed that the hospital database seems unaffected from the cyber attack. However, the claims of the threat actors contradict the same.

In a statement given to 9News, NSW said, “NSW Health continues to investigate this issue which does not appear to have impacted any NSW Health databases, nor Crown Princess Mary Cancer Centre databases. The safety and security of all NSW Health systems remains of highest importance and is continually monitored and safeguarded.

“NSW Health works closely with state and federal Government cyber security agencies to ensure that any cyber event is prevented, detected and responded to in the most appropriate manner,” it added.

The Medusa ransomware gang has featured as one of the most active cyber extortion groups in recent years. Earlier this year, it targeted Minneapolis Public Schools in the US and demanded a ransom of $1 million. Once the deadline expired on March 17, the group published the data stolen from MPS.

The leaked data included current and former student records, parent contacts, home addresses, IDs with pictures, grades, sensitive disciplinary and health records, budgets, contracts, grant information, building layouts, payroll, and human resources information.

The leaked files also contained even more sensitive data about students and teachers, including allegations of teacher abuse and students’ mental health reports, details of students’ behavioural issues and social security numbers of teachers.