Backmydata

Backmydata is a variant of the Phobos ransomware family, a type of malware that has been used in sophisticated cyber attacks on healthcare systems. The landscape of these attacks is rapidly evolving with groups like RansomHouse, Rhysida, and Backmydata employing increasingly advanced tactics. In one notable incident, an unidentified threat actor infected systems at approximately 100 hospitals in Romania by first targeting a central health information system to which they were connected. This attack was executed using the Backmydata malware, which demanded a ransom of 3.5 BTC or 157,000 euro. The method of breach was highly sophisticated, with the suspected entry point being the RSC infrastructure’s website. The attackers utilized Backmydata ransomware, which is part of the larger Phobos family. As of now, no specific group has claimed responsibility for encrypting the servers of Hippocrates Information System, but it is confirmed that the Backmydata ransomware was used in the attack. In response to the growing threat, US CISA, the FBI, and MS-ISAC issued a joint cybersecurity advisory (CSA) in March 2024 to warn of attacks involving Phobos ransomware variants such as Backmydata. They urged all health entities to scan their IT&C infrastructure using the Indicators of Compromise (IOCs), regardless of whether they had been affected by the Backmydata ransomware attack. This highlights the critical importance of proactive measures in preventing such cyber attacks.