LockBit Attack on MCNA Leaves Millions Compromised

Managed Care of North America (MCNA), a prominent healthcare provider, recently disclosed a major data breach, revealing that the personal data of almost 9 million patients, including patients, parents, and guardians, had been compromised.

The threat actors behind this attack are the notorious LockBit Ransomware gang, one of the world’s most active and successful cybercrime organizations. With this single attack, the LockBit gang demonstrated their ability to compromise millions of individuals’ security and privacy.

MCNA stated they became aware of unauthorized access to their computer systems on March 6th, 2023, with their investigation revealing that the LockBit ransomware gang first gained access to MCNA’s network on February 26th, 2023.

During the period of unauthorized access, the LockBit gang stole identifying information, such as names and addresses, Social Security numbers, and government-issued ID numbers. Health insurance information, dental care records, associated billing, and insurance claims were also compromised.

On March 7th, 2023, the LockBit gang first published the stolen data samples on their website. Following this, they threatened to release a massive 700GB of sensitive patient data unless MCNA paid a ransom of $10 million.

When the ransom was not paid, LockBit published all the stolen data on its website, pushing the information into the public domain. This exposed the victims to increased risks, including identity theft and other fraudulent activities.

In response to the breach, MCNA contacted law enforcement authorities to help prevent the misuse of the stolen data. They also have taken steps to strengthen the security of their systems to prevent similar incidents from happening in the future.

Acreto Solution

Acreto offers a comprehensive approach to addressing the threats posed by ransomware. By leveraging the power of Ecosystems:

• Ecosystems Acreto’s Ecosystem approach allows an organization to build a dedicated security infrastructure for each application, use case, project, or third-party. This inherently limits access to only the users, devices, systems, and applications that need to interoperate together. By creating this contained environment, Acreto helps prevent unauthorized access and reduces the attack surface, which would be crucial in fending off attacks like LockBit’s.

• Elimination of Attack Surfaces Acreto’s solution aims to eliminate both Internet and internal attack surfaces. It achieves this by employing micro-segmentation and nano-segmentation to isolate individual or groups of systems on a shared network, preventing the lateral movement of attackers, which is a common tactic used in ransomware attacks.

• Encrypted Secure Scan Acreto’s Encrypted Secure Scan decrypts, scans, and re-encrypts communications inline and in real-time. Any malicious content embedded in the encrypted payload is blocked. This helps in preventing the initial intrusion of ransomware into the network.

• Access Control Acreto utilizes multi-factor authentication (MFA) and unique device identities to control access to its Ecosystems. This stringent control can help prevent unauthorized access, which was the initial entry point of the LockBit gang in MCNA’s case.

• Content and Threat Prevention Acreto’s solution controls communication-based on content categories, and has capabilities for data leak prevention, and threat prevention. It can identify and mitigate known exploits, malware, botnets, and ransomware and also has a zero-day behavioral analysis feature to detect new, unknown threats.

• Policy and Change Management Since Ecosystems operate independently, the impact of any change management is limited to the members of a specific Ecosystem. This simplified approach reduces the risk of a widespread attack and facilitates efficient policy management.

Contact Acreto today for more information or to evaluate Ecosystem security for your organization.

Ecosystem Security Isolation

Ecosystems deliver a dedicated security infrastructure that can be deployed per application, use-case, project or third-party. An Ecosystem inherently limits access only to users, devices, systems and applications that need to interoperate together.

Ecosystems support any technology, on any network, anywhere in the world. These include computers, mobile devices, IoTs, Offices, Clouds, SaaS and Data Centers.

Ecosystems can be configured as:

Eliminate the Internet Attack Surface

Eliminates any and all access from the Internet while Ecosystem members can interoperate with authorized systems and applications.

Eliminate the Internal Attack Surface

Ecosystems can easily isolate individual or groups of systems on a shared network or entire networks, to limit access only to systems that need to interoperate together. This is done with

• Micro-Segmentation Segmenting groups of systems on any shared network, including hostile networks or the entire network.

• Nano-Segmentation Isolating an individual system, device or application to limit access only to other authorized Ecosystem members.

Isolated Data Flows

Isolated data flows can be defined between two Ecosystem members to limit access to specified sources and destinations, network protocols and ports, application protocols as well as application programs.

Encrypted Secure Scan

Secure Scan addresses a key weakness in many security tools today. 90%+ of all communications is encrypted, yet only 10% of organizations have the means to secure these communications. Encrypted Secure Scan decrypts, scans, and re-encrypts communications inline and in real-time.

Any malicious content embedded in the encrypted payload is blocked, otherwise the clean and validated communication is delivered to its final destination.

Controls

• User Authorizes access to the Ecosystem by a user’s identity, including MFA, as authenticated by the organizations’ Directory Services such as Active Directory or LDAP, as well as third-party Identity Service Providers such as Okta, Ping, Duo, and CloudJump among others.

• Device Specifies a unique identity to each device to validate that a specified device that does not rely on a user to operate – such as an autonomous application or IoT, is allowed to join the Ecosystem.

• Credit Cards Upload / Download Controls

• Social Security Number Upload / Download Controls

• RegEx Pattern Upload / Download Controls

Threat Prevention

After verification of network protocol, port, application protocol and application program, a deep inspection is performed on all communications. The effectiveness of this method is amplified by inline Encrypted Secure Scan. Threat prevention capabilities utilize two key methods:

Simplicity

Acreto Ecosystems are very easy to provision and deploy. There are no hardware dependencies or associated logistics.

Provisioning an Ecosystem takes 3-5 minutes. Simply provide a unique name to the Ecosystem then choose the bandwidth desired and within a few minutes your Ecosystem providing a dedicated security infrastructure is ready.

Depending on your connection options for Ecosystem members, deployment can take between 10 minutes to a few hours.

Sustainability

Acreto Ecosystems utilize a sustainable model without any dependency on products and their associated logistics. There are no more updates, upgrades or technology refreshes.

Change Management

Different Ecosystems operate completely independently from one-another. Therefore, change management impacts only members of a specified Ecosystem, not the entire organization. This simplifies the traditionally complex change management process.

Policy Management

Policy management also benefits from Ecosystems. Because Ecosystems are specific to a customer scenario such as an application, use-case, project or third-party, all policies apply to the scenario. Moreover, when its time for policy cleanup, when an application or use-case is retired, disabling or deleting the Ecosystem automatically prunes the policies. This has traditionally been a complex task that is at best inaccurate.

About Acreto

Acreto delivers full-stack cybersecurity without products, logistics or significant security expertise. It creates and consolidates the best of cybersecurity into a single plug-and-play platform with automated updates to stay ahead of threats. Acreto activates enterprise-grade security instantly, so organizations can run safely, easily, and without interruption.