Hackers claimed to have sold the data of Lurie Children's Hospital of Chicago patients for $3.4 million following a recent cyberattack, the Record reported March 7.
The Rhysida ransomware group listed Lurie Children's on its dark web extortion page in February, offering the data for 60 bitcoins, or about $3.4 million, according to the news outlet. The site was updated in recent days to say: "All data was sold."
Lurie Children's took its IT and phone systems offline Jan. 31, following what it later called a cyberattack from a "known criminal threat actor." The outage led to canceled appointments and surgeries and widespread confusion among patient family members. The hospital, one of the largest pediatric healthcare organizations in the Midwest, restored its EHR recently but said its MyChart patient portal remains down.
"We are aware that individuals claiming to be Rhysida, a known threat actor, claim to have sold data they allege was taken from Lurie Children’s," the hospital said in a statement to Becker's. "We continue to work closely with internal and external experts as well as law enforcement, and are actively investigating the claims. The investigation is ongoing, and we will share updates as appropriate."
The FBI told Becker's it had no updates beyond a previous statement that it is assisting in the investigation.