Crozer-Keystone Health System (Delaware County, PA) Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 1, 2020, Crozer-Keystone Health System in Delaware County, Pennsylvania, was listed on a site associated with the revil ransomware group. The entry states that internal files were taken during a ransomware attack, though the number of individuals affected and the precise contents of those files have not been disclosed. The listing means that any patient records, employee information, or operational documents held by the health system could be at risk of further distribution. Without Reported Details on scale or verification of the data, those connected to the organization have limited information on whether their personal details are involved.

Breaking down the breach

The incident was reported on June 1, 2020, when Crozer-Keystone Health System appeared on the revil ransomware leak site. The group claims to have stolen internal data during a ransomware attack, and the published entry refers to exfiltrated internal files. No figure for the number of people affected has been released, and the organization has not confirmed the volume or specific nature of the material taken.

Public records do not include the date of the initial intrusion, the method used to gain access, or whether any ransom demand was issued or met. The only confirmed element is the appearance of the health system on the leak site and the group's assertion that files were removed.

Inside revil

REvil is a ransomware-as-a-service operation that has conducted numerous attacks on businesses and public-sector entities. Its typical pattern involves encrypting systems and copying data, followed by threats to publish the copied material unless payment is made. The group maintains a leak site where it lists victims and sometimes posts samples of stolen files to pressure targets.

In this case the listing itself constitutes the group's claim that data from Crozer-Keystone was obtained. No independent confirmation of the claim or of any subsequent release of files has been made public.

Crozer-Keystone Health System (Delaware County, PA) and its sector

Crozer-Keystone Health System operates hospitals and outpatient facilities serving Delaware County and surrounding areas in Pennsylvania. Like other health systems, it maintains electronic records that support clinical care, billing, and regulatory compliance. These records commonly include patient identifiers, treatment histories, and insurance details, as well as administrative data on staff and vendors.

Healthcare providers are frequent targets for ransomware because their operations depend on continuous access to records and because the data they hold can retain value on illicit markets. A listing on a leak site therefore raises questions about the protection of information that patients and employees entrust to the organization.

The information in question

The only detail released is that internal files were allegedly exfiltrated. No inventory of file types, patient counts, or specific data fields has been published. Healthcare organizations routinely store names, dates of birth, medical record numbers, diagnoses, and financial information, yet it remains unconfirmed whether any of these categories appear in the material referenced by the leak-site listing.

Until the health system or investigators release additional information, the exact scope of exposure cannot be determined from public sources.

Why it matters

Individuals whose records may be among the exfiltrated files face the possibility that their personal or medical information could be used for identity theft, insurance fraud, or other misuse. Even without confirmed distribution, the existence of a leak-site entry creates ongoing uncertainty for patients and staff.

For the organization, the incident adds to the operational and regulatory burdens that follow any ransomware event, including potential notification requirements and the cost of restoring systems and reviewing security controls. The absence of disclosed numbers or data categories leaves both the public and the health system with incomplete information for assessing harm.

What to do if you're exposed

Anyone who receives a notification from Crozer-Keystone or who believes their information may be involved should review account statements for unusual activity and place fraud alerts with credit bureaus. Changing passwords for any linked online portals and enabling multi-factor authentication on health and financial accounts are immediate steps that limit further access.

Readers can also run a free exposure scan of their email address to check whether it appears in known breach data sets maintained by public monitoring services.

AICompiled with AI assistance from public sources and published under our editorial standards.