Cyber Incident Victim: Las Vegas Cancer Center
Date:
Sep 2021
Location:
United States of America
Summary
A cancer center in Las Vegas experienced a ransomware attack during a holiday weekend, discovered upon reopening, which compromised encrypted patient data including names, addresses, dates of birth, Social Security numbers, medical records, and insurance information. The organization asserted the proprietary format of the data would render it unusable to attackers, with approximately 3,000 individuals impacted. The Pysa ransomware group later claimed responsibility for the incident but had not publicly released any exfiltrated data at the time of reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The Las Vegas Cancer Center experienced a ransomware attack during the Labor Day weekend of 2021, with the intrusion discovered on September 7 when the facility resumed operations. Threat actors encrypted data stored on the center's systems and accessed sensitive patient information. Compromised data included patient names, addresses, dates of birth, Social Security numbers, medical records, and insurance information. The center maintained that the data was stored in a proprietary format, asserting this would prevent threat actors from utilizing the information effectively. Approximately 3,000 patients were affected by the breach, according to notifications issued by the center. Initial reports did not identify the perpetrators or specify any ransom demands made to the organization.
In subsequent developments, the Pysa ransomware group claimed responsibility for the attack by November 9, 2021, though no data leaks from the incident had been publicly observed at that time. The cancer center's public disclosures did not elaborate on technical containment measures, forensic investigations, or system restoration timelines following the attack. No information was provided regarding whether the organization engaged law enforcement or cybersecurity firms to address the incident. The breach notification process confirmed the exposure of multiple categories of personally identifiable information and protected health information, but did not describe specific operational disruptions or financial impacts resulting from the encryption event. Patient communications focused on the data compromise rather than detailing clinical service interruptions during or after the attack period.