Skip to main contentSkip to navigationSkip to navigation
Patients who had cosmetic surgery have had their pictures and details leaked by hackers.
More than 1,500 British patients are listed in the database. Photograph: kopitinphoto/Getty Images/iStockphoto
More than 1,500 British patients are listed in the database. Photograph: kopitinphoto/Getty Images/iStockphoto

Hackers publish private photos from cosmetic surgery clinic

This article is more than 6 years old

Criminal group that broke into servers of Lithuanian clinic demands bitcoin ransom payments from clients after releasing 25,000 pictures

Hackers have published more than 25,000 private photos, including nude pictures, and other personal data from patients of a Lithuanian cosmetic surgery clinic, police say.

The images were made public on Tuesday by a hacking group calling themselves “Tsar Team”, which broke into the servers of the Grozio Chirurgija clinic earlier this year and demanded ransoms from the clinic’s clients in more than 60 countries around the world, including the UK.

Police say that following the ransom demand, a portion of the database was released in March, with the rest following on Tuesday. It’s unclear how many patients have been affected, but police say dozens have come forward to report being blackmailed. “It’s extortion. We’re talking about a serious crime,” the deputy chief of Lithuania’s criminal police bureau Andzejus Raginskis told reporters.

More than 1,500 British patients are listed in the database. Hackers demanded ransom payments of between €50 and €2,000, paid in bitcoin, depending on the sensitivity of the data stolen – with nude photos, passport scans and national insurance numbers all serving to bump up the ransom requested.

Prior to parcelling out the ransoms patient by patient, the hackers attempted to offer the entire database up for sale for 300 bitcoin – currently worth more than half a million pounds – but the clinic refused to pay. The full database has since been reduced to 50 bitcoin, or about £100,000.

Lithuanian police say they are working with security services in other European countries, and have warned that people who download and store the stolen data could also be prosecuted.

“Clients, of course, are in shock. Once again, I would like to apologise,” Jonas Staikunas, the director of Grozio Chirurgija, told local media. “Cybercriminals are blackmailers. They are blackmailing our clients with inappropriate text messages.”

Lithuanian business site 15min reported that the hack turned attention to the nation’s cybersecurity issues more generally: more than half the country’s sites can be easily attacked, according to a national status report, with “clinics, travel agencies and private doctors’ offices” all highlighted as vulnerable.

Healthcare information security has been in the spotlight following the worldwide outbreak of the WannaCry ransomware attack, which took down IT systems in multiple NHS trusts in early May. But that attack, which saw computers across the UK encrypted with the code required to unlock them sold for $300, was the result of a scattershot campaign, with some falling prey to phishing emails. The Lithuanian attack is far more targeted, and the hackers have been more tenacious in trying to secure their payout.

The Grozio Chirurgija clinic has warned patients on its website not to engage with the blackmailers, or download anything sent to them, for fear of further attacks. Any patient who is contacted by the hackers should inform the police immediately the clinic said.

Tsar Team is another name for the hacking group known to security researchers as APT28 or “Fancy Bear”, which has been linked to hacks on the Democratic National Committee, En Marche and the Konrad Adenauer Foundation. It is not yet known whether the hackers that attacked Grozio Chirurgija are linked to APT28, or if they’re an unrelated group that adopted the same name for disinformation purposes.

Most viewed

Most viewed