Twister Canyon
Attribution profile
- Type
- Criminal
- Location
- China
- Known incidents
- 1 incident
- Sources
- 1 source
- First seen
- 2020-02-25
- Last seen
- 2020-02-25
- Updated
- 2026-10-03 01:37
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Twister Canyon, also known by the alias Twister Canyon, is a threat actor linked to China. The actor targeted healthcare organizations, specifically MCG Health and its affiliated clients, gaining unauthorized access to patient data that included names, Social Security numbers, medical codes, addresses, phone numbers, email addresses, dates of birth, and gender. The actor’s observed objective was financial extortion, as they demanded payment for the return of the stolen records and allegedly offered the data for sale on the dark web. No public attribution to a state sponsor or criminal consortium has been established. The most notable campaign associated with Twister Canyon is the MCG Health breach disclosed in 2022, which affected over 1.1 million individuals across multiple healthcare providers. No further details on malware families, initial access vectors, or tooling style are provided in the available sources.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 1 source.