Daixin Team targets 10 million Acadian Ambulance records

Acadian Ambulance faces a severe cybersecurity breach after the Daixin Team claimed to have encrypted up to 2,000 of its servers and threatened to publish sensitive patient data of 10 million individuals unless a $7 million ransom is paid.

What happened

On June 21, 2024, the ransomware group 'Daixin Team' encrypted 1,000 to 2,000 servers belonging to Acadian Ambulance, a healthcare service provider across Louisiana, Mississippi, Tennessee, and Texas. 

Despite the severity of the breach, the Acadian Ambulance website and social media do not mention the cyberattack. 

Acadian’s lack of communication contradicts its HIPAA privacy policy, which states, “We are required by law to maintain the privacy and security of your protected health information. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.” 

Going deeper

Daixin demanded a ransom of $7 million, while Acadian initially offered less than $173,000, eventually increasing their offer to $572,500. However, negotiations broke down. 

Daixin claims to have the protected health information (PHI) of 10 million individuals, including sensitive data fields from employee records. Daixin also provided screenshots of compromised two-factor authentication (2FA) screens and a list of database tables containing patient and employee information.

What was said

According to Acadian’s cyber statement, “Because of the systems in place, the steps taken prior to this incident, and the immediate actions of our IT, Compliance, and Operational teams, Acadian was able to continue operations with no negative impact on patient care.”

However, “it appears that these threat actors were able to gain access to a secure server containing protected health information, as that term is defined under the Health Insurance Portability and Accountability Act (HIPAA).”

Why it matters

As ransomware attacks increasingly target sensitive healthcare data, including PHI, impacting individual patient privacy and the operational stability of healthcare providers like Acadian. These attacks can result in substantial financial losses for healthcare organizations, as well as potential legal and regulatory consequences for HIPAA violations. 

Learn more: HIPAA Compliant Email: The Definitive Guide