Cyber Incident Victim: Atlanta Allergy & Asthma
Date:
Mar 2021
Location:
United States of America
Summary
Atlanta Allergy & Asthma, a large allergy practice, was targeted by Nefilim ransomware threat actors who stole sensitive patient data and threatened to release approximately 19GB of files unless extortion demands were met. The attackers leaked a sample of 1.3GB of compressed data containing protected health information spanning multiple years, including insurance records, outstanding claims, and detailed patient audits affecting thousands of individuals. The compromised files comprised billing documents, electronic remittance details, and multi-page case reviews, with the threat actors publicly listing the organization on their Dark Web leak site to pressure payment; the entity did not publicly respond to inquiries about the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around March 3, 2021, Atlanta Allergy & Asthma (AA&A), a medical practice specializing in allergy and asthma treatment across 17 locations, experienced a ransomware attack attributed to the Nefilim threat actor group, also known as Nemty. The attackers compromised AA&A's systems and exfiltrated sensitive data, subsequently listing the organization on Nefilim's dedicated Dark Web leak site. This listing included a preliminary data sample intended to pressure the practice into meeting extortion demands. The threat actors claimed possession of approximately 19GB of the entity's files, threatening to release the full dataset if payment was not made.
The compromised data included 1.3GB of compressed files, expanding to 2.5GB upon extraction, containing 597 files with protected health information (PHI) pertaining to thousands of identifiable patients. Exfiltrated records spanned multiple years, including billing spreadsheets categorized by insurance type and unresolved claims from 2017 and 2018 stored in an "Electronic Remits" folder. Over 100 patient audit files—detailed, multi-page case reviews—were also among the stolen data. The breach exposed sensitive clinical and financial information, creating significant privacy risks for affected individuals. AA&A did not publicly acknowledge the incident or provide details about its response at the time of initial reporting, as no reply was issued to media inquiries regarding mitigation efforts, operational impacts, or patient notifications. The attackers' publication of sample data confirmed the compromise but left the full scope of organizational consequences undocumented in available sources.