Octapharma Plasma has blamed IT "network issues" for the ongoing closure of its 150-plus centers across the US. It's feared a ransomware infection may be the root cause of the medical firm's ailment.

"All centers are experiencing network issues and are currently closed," according to a  banner across the top of the company's website. 

One source familiar with the situation, however, told The Register Octapharma Plasma fell to a BlackSuit ransomware infection on Monday. We're told the downtime stateside will affect supplies of plasma into Octapharma's European operations.

"If they don't restore the systems, they will need to close their factories in Europe as more than 75 percent of their plasma comes from the US," the source told us. "IT management don't give a s*** about security and they are now learning a lesson."

Octapharma Plasma, which operates more than 150 blood plasma donation centers across America and claims to employ more than 3,500 people nationally, did not respond to The Register's inquiries.

"Further updates on reopening will be sent via email, social media, OctaApp, and our website," Octapharma noted on its website today.

Parent company Octapharma Group, which is based in Germany and has operations across 118 countries, boasted operating income of €436 million ($464 million) in 2023, with record-setting sales of €3.266 billion ($3.48 billion).

The criminals broke into the plasma giant's VMware systems before deploying the BlackSuit ransomware, our source claimed.

BlackSuit is a relatively new strain of ransomware, which shares code with Royal - and may even be a rebrand of that particular crew. And Royal was a successor to Conti, after the notorious Russian crew disappeared in June 2022.

In November, the US Department of Health and Human Services warned [PDF] that BlackSuit was aggressively targeting healthcare and public health organizations using double-extortion tactics: First stealing sensitive files and then encrypting the data on compromised networks before demanding a ransom payment.

Our source close to the alleged Octapharma infection didn't know if any extortionists had made any ransom demand, or if the company was negotiating with a crew. We're told the FBI has been alerted, and we've asked the federal bureau for comment.

If it does turn out to be ransomware, Octapharma will join a growing list of US hospitals, health centers and medical firms that have been hit so far this year, as criminals increasingly target these critical orgs. 

Encrypting hospital and pharmacy systems with malware may prevent patients from accessing life-saving treatments and medications. Plus, patients and donors trust healthcare companies to protect their sensitive medical and financial details, which puts these providers at risk of class-action lawsuits and investigations if they breach that trust and allow protected information to leak.

All of this means that the healthcare sector, when facing extortion demands, is more likely to pay a ransom. And that makes the entire industry a prime target for financially motivated crime gangs that have been using increasingly vile extorion tactics to force medical facilities to pay up. ®

https://www.theregister.com//2024/04/18/ransomware_octapharma_plasma/