Lehigh Valley Health Network refused ransom after BlackCat attack on physician practice

Lehigh Valley Health Network, a Pennsylvania hospital system, disclosed on 20 February 2023 that it had been attacked by the BlackCat ransomware operation, which it described as associated with Russia.

LVHN said its technology team detected unauthorised activity within its IT systems on 6 February 2023, launched an investigation, engaged outside cybersecurity firms and notified law enforcement. Its initial analysis pointed to the network supporting a single physician practice in Lackawanna County, identified in reporting as the Delta Medix practice.

The health network said the affected environment included a computer system used for clinically appropriate patient images for radiation oncology treatment, along with other sensitive information. It said it could not yet determine whether any specific patient's personal information had been compromised, and would notify individuals once that was established.

BlackCat demanded a ransom payment. LVHN refused and did not disclose the amount sought. A US Department of Health and Human Services report cited by WFMZ noted the group had demanded as much as 1.5 million dollars in earlier attacks on healthcare organisations. LVHN said the attack had not disrupted its operations, although some of its websites were briefly unavailable.

As of the reporting date the investigation into the scope of the data involved was continuing.