Cyber Incident Victim: Sincera
Date:
Nov 2020
Location:
United States of America
Summary
Abington Reproductive Medicine was listed on Maze's ransomware leak site, but the proof files provided by the attackers were unrelated to the practice, suggesting the listing may have been mistaken. The practice, now known as Sincera, did not respond to multiple inquiries from DataBreaches.net. No public statements or notifications to patients or regulators have been identified, and the incident remains unconfirmed by the entity.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Abington Reproductive Medicine was listed on the Maze Team's dedicated ransomware leak site, as reported by DataBreaches.net. The listing occurred without any accompanying public disclosure from the medical practice itself. A notable and unusual detail from the threat actors' posting was that the "proof" files they provided to demonstrate access to the victim's systems had no apparent connection to a medical practice, raising immediate questions about the legitimacy of the claimed attack. DataBreaches.net specifically queried whether Maze had genuinely compromised Abington or if incorrect data had been uploaded. The practice, which has since changed its name to Sincera, did not respond to two separate inquiries from the reporting site seeking comment or clarification on the incident. Consequently, there is no information from the entity regarding the scope of any potential incident, the systems or data potentially involved, or the timeline of discovery.
The absence of any response from Abington Reproductive Medicine means there is no confirmation of a security incident, no details on what, if any, protected health information or personally identifiable information may have been accessed or exfiltrated, and no account of any internal detection or containment efforts. The practice also issued no public notice on its website, filed no report with the U.S. Department of Health and Human Services' public breach portal as of the article's publication date, and provided no press release or media statement. The only observable actions are the external listing by the ransomware group and the subsequent corporate name change to Sincera. The article explicitly states that DataBreaches.net could not verify the attack's validity due to the irrelevant proof files and the complete lack of communication from the former Abington Reproductive Medicine.