Nation-State Healthcare Espionage — Research Reference

78.8 million records. DOJ indicted Fujie Wang (May 2019) — spear-phishing, Sakula malware, lateral movement over months. Names, SSNs, medical IDs, employment info, income data. Same malware tools (Sakula, Mivast/Derusbi) used exclusively by Chinese APT campaigns.

2026-03-15 7 min read Research file
Contents

The Anthem Breach (2015)

78.8 million records. DOJ indicted Fujie Wang (May 2019) — spear-phishing, Sakula malware, lateral movement over months. Names, SSNs, medical IDs, employment info, income data. Same malware tools (Sakula, Mivast/Derusbi) used exclusively by Chinese APT campaigns. FBI linked to same group behind OPM breach.

$115M class action settlement. $16M HHS HIPAA settlement (record). $48.2M to state AGs.

The Systematic Chinese Campaign

Not isolated incidents — a coordinated dossier-building operation. Cross-referenced: hotel behavior (Marriott), financial data (Equifax), healthcare (Anthem/Premera/CHS), security clearances (OPM). iSight Partners identified same “digital fingerprint” across Anthem, Premera, and OPM with “high confidence.”

Equifax (2017): 147M Americans. Four members of the PLA’s 54th Research Institute indicted February 2020. Exploited Apache Struts.

Marriott/Starwood (2014-2018): 383M guest records (revised down from the initial 500M estimate) including passport numbers. MSS attributed.

Community Health Systems (2014): 4.5M patient records. APT18 (Dynamite Panda). Heartbleed vulnerability. 206 facilities, 29 states.

Premera Blue Cross (2014-2015): 11M records including medical claims, bank data. Same group as Anthem.

APT Groups Targeting Healthcare

HHS HC3 (August 2023): Threat profile identifies APT41, APT10 as deliberate threats to US healthcare — targeting medical technology IP, medicine research, public health data.

APT41 (Winnti): Healthcare sector targeted 2014-2020. DOJ indicted five Chinese citizens September 2020 for hacking 100+ institutions. MSS linked.

APT10: MSS’s Tianjin State Security Bureau. Targets healthcare across six continents.

Russian Ransomware and Healthcare

The state-criminal nexus: Recorded Future’s “Dark Covenant” series documents evolution from passive tolerance to active management. FSB connections to Conti confirmed in leaked chats. Two rules: never attack Russia, and do favors for intelligence on demand.

Universal Health Services (September 2020): Ryuk ransomware. All ~400 facilities. $67M in losses. Three weeks offline.

Irish Health Service Executive (May 2021): Conti. Biggest attack on Irish state agency ever. 473 lawsuits. Paper records for weeks.

Change Healthcare (February 2024): ALPHV/BlackCat. 192.7 million Americans. $22M ransom paid. $2.87B total cost in 2024 (UnitedHealth’s full-year figure; $2.457B through the first nine months). Entry via compromised Citrix credentials, no MFA. Secondary extortion by RansomHub after initial payment.

Deaths: Springhill Medical Center baby death lawsuit (July 2019) — clinicians lacked fetal monitoring during ransomware outage. Settlement reached. Düsseldorf University Hospital (September 2020) — woman diverted 19 miles, died. German prosecutors later disputed ransomware attribution.

Medical Device Vulnerabilities

Medtronic pacemaker (Rios/Butts, Black Hat 2018): CareLink 2090 programmer (~33,000 in use) lacked encryption for updates. Could install malicious firmware to deliver or prevent shocks. FDA advisory issued.

Dick Cheney’s pacemaker (2007, disclosed 2013): Cardiologist disabled wireless capability to prevent assassination via remotely triggered cardiac arrest.

Infusion pumps: FDA alerted hospitals Hospira Symbiq could be remotely accessed to change dosage. Medtronic MiniMed insulin pumps: unauthorized wireless connection could overdeliver insulin or stop delivery. 4,000 patients vulnerable.

Legacy systems: 73% of healthcare providers use equipment on legacy OS. Infusion pumps = 38% of connected hospital devices. Three hospitals found with backdoors and botnet connections installed via Windows XP exploits.

BGI Group — Genetic Data as Intelligence Target

NIFTY prenatal test sold in 52+ countries. 8.4+ million women tested. Data stored in BGI labs or China’s national gene bank. Reuters: developed in collaboration with the PLA. 2018 BGI study used military supercomputer to re-analyze NIFTY data — mapped virus prevalence, identified mental illness indicators, singled out Tibetan and Uyghur minorities.

NCSC fact sheet warns specifically about Chinese collection of genomic/healthcare data. China’s 2017 National Intelligence Law requires Chinese firms to share proprietary information with government on request.

DARPA/bioweapon concern: US intelligence warned China could use genetic data to create targeted bioweapons designed to attack specific racial/ethnic groups. A Chinese general who ran the National Defense University wrote that the most effective bioweapons target specific groups.

COVID Vaccine Research Espionage

Russia — APT29 (Cozy Bear): Joint UK/US/Canada advisory July 2020. Targeted vaccine development in all three countries using WellMess and WellMail malware.

China: DOJ indicted Li Xiaoyu and Dong Jiazhi (July 2020) for decade-long hacking including probing COVID vaccine researchers. MSS contractors. Moderna confirmed FBI contact.

North Korea: Attempted to hack Pfizer for vaccine/treatment information. Spoofed login pages.

EHR Concentration Risk

Epic: 42.3% of US hospitals (54.9% by beds). Oracle Health: 22.9%. Together ~65% of market. Compromising either = tens of millions of records.

Oracle Health breach (2025): Stolen credentials accessed legacy Cerner servers (January 22). Up to 80 hospitals. Threat actor “Andrew” extorted providers.

Five Eyes Health Data Sharing

UK NHS / Palantir: £330M contract for Federated Data Platform. Less than a third of trusts adopted by May 2025. Concerns: Palantir’s surveillance history, potential police/Home Office access.

UK GPDPR data grab (2021): Proposed extracting GP histories of 55M people. Pseudonymised, not anonymised — re-identification acknowledged. 3+ million opt-outs. Delayed twice.

Australia My Health Record (2018): 24.7M citizens, retained 30 years after death. Section 70 allows disclosure to “enforcement bodies” without warrant. 2.5M opted out (9.9%).

Persistent Access — “Assume Breach”

Volt Typhoon: CISA/NSA/FBI joint advisory (February 2024): PRC actors maintained persistent access to US critical infrastructure for at least five years, pre-positioning for disruptive attacks in event of conflict. Living-off-the-land techniques.

Salt Typhoon: 9+ telecoms compromised starting 2022. As of late 2024, investigators could not confirm full eradication or determine full scope. In August 2025 the FBI’s cyber chief said the group had hacked at least 200 American companies and broken into companies in 80 countries (TechCrunch), and a joint advisory from US and allied agencies described PRC state-sponsored actors targeting “large backbone routers of major telecommunications providers” and pivoting from them into other networks (CISA AA25-239A).

The Intelligence Value of Health Data

Medical records sell for $1,000+ per record on dark web. Espionage = nearly 1 in 6 healthcare breaches. Health data contains immutable details (diagnoses, genetics, mental health, prescriptions) useful for blackmail, recruitment, population analysis.

The PRC views bulk personal data as a “strategic commodity” (NCSC language). Combined with OPM + Anthem + Equifax + Marriott = identification of intelligence officers, recruitment of compromised individuals, population-level analysis comparable to signals intelligence.

researchthe-ratchethealth-datanation-statebreaches
← OlderNSA / Snowden Surveillance Infrastructure — Research Reference Newer →Intelligence Portal Compromises — Research Reference

Get updates on the Evil Robots series

Newsletter essays on AI escape, deception, and the humans who built them.