Anatomy of a Breach

Anatomy of a Breach: Virginia's $10 Million Prescription Ransom — The Birth of Cyber Extortion

> series: anatomy_of_a_breach —— part: 006 —— target: virginia_dhp —— records: 8,257,378 —— ransom: $10,000,000<span class="cursor-blink">_</span>_

Hedgehog Security 30 June 2009 12 min read

'I have your stuff.' $10 million or it goes to the highest bidder.

On 30 April 2009, visitors to the Virginia Prescription Monitoring Program website were greeted not by the expected login page but by a ransom note: 'ATTENTION VIRGINIA. I have your [expletive]! In my possession, right now, are 8,257,378 patient records and a total of 35,548,087 prescriptions. Also, I made an encrypted backup and deleted the original. Unfortunately for Virginia, their backups seem to have gone missing, too. For $10 million, I will gladly send along the password. You have 7 days to decide.'

The Virginia Department of Health Professions immediately suspended all its servers and called in the FBI and Virginia State Police. The prescription monitoring database tracked controlled substances — OxyContin, Vicodin, and other powerful narcotics — to prevent abuse and diversion. It held names, social security numbers, addresses, and detailed prescription histories for millions of Virginians. If the hacker's claims were true, it was one of the most serious healthcare data compromises in US history — and one of the most brazen acts of cyber extortion ever attempted.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

The ransomware playbook — written in 2009.

The Virginia prescription ransom occurred years before ransomware became a household word. CryptoLocker, often cited as the first major ransomware campaign, would not emerge until 2013. WannaCry would not devastate the NHS until 2017. But the Virginia attacker's methodology — compromise the target, encrypt or delete the data, destroy the backups, demand payment — is exactly the playbook that ransomware groups use today. This was not technically ransomware in the modern sense (the encryption was done manually, not by automated malware), but it was the same concept, executed at a scale that foreshadowed the epidemic to come.

What made this case particularly alarming was the claim that the backups had also been compromised. If true, it meant the state of Virginia had no independent copy of its prescription monitoring data — a scenario that remains the nightmare outcome for any organisation hit by ransomware today. The importance of offline, immutable backups — a lesson the Virginia breach taught in 2009 — is still not universally implemented. Our healthcare sector analysis discusses why healthcare backup strategies remain inadequate.


How a government health database was left exposed.

Internet-Facing Government Database
The Prescription Monitoring Program was accessible via the internet to approximately 2,500 healthcare professionals. The web application that provided access contained vulnerabilities that allowed the attacker to breach the system. Government web applications — particularly those handling sensitive health data — require the same level of security testing as any commercial platform. Our <a href="/penetration-testing/web-application">web application testing</a> routinely assesses public-sector applications against this standard.
No Encryption of Data at Rest
The patient records and prescription data were stored without encryption. When the attacker gained access to the database, the data was immediately readable — no additional barriers existed between access and exfiltration.
Backup Integrity Not Verified
The attacker claimed to have deleted both the primary data and the backups. Whether the backups were genuinely destroyed, stored on the same accessible infrastructure, or simply never tested is unclear — but the state's inability to quickly restore from backup suggests that backup procedures were inadequate. Backup verification and restoration testing remains a critical gap we identify in our <a href="/penetration-testing/infrastructure">infrastructure assessments</a>.
Insufficient Access Controls
With 2,500 authorised users accessing the system via the internet, the attack surface was substantial. The web application's authentication and authorisation mechanisms were not robust enough to prevent the attacker from gaining administrative access to the underlying database.

Web application testing would have prevented this.

Vulnerability What Testing Would Have Found
Web application vulnerabilities A web application penetration test of the Prescription Monitoring Program would have identified the vulnerabilities the attacker exploited to gain access — before they were exploited in anger.
Database access from web tier An infrastructure test would have assessed whether the web application could access the database directly, without appropriate segmentation, input validation, or privilege separation.
Backup accessibility A security assessment would have tested whether backups were stored on infrastructure accessible from the same network as the primary systems — and whether they could be deleted by an attacker who compromised the production environment.
No monitoring or alerting The attacker replaced the website's homepage with a ransom note and allegedly deleted millions of records — without triggering any alerts. SOC in a Box monitors for exactly these indicators: website defacement, bulk data deletion, and anomalous database activity.

From Virginia 2009 to ransomware 2025.

The Virginia prescription ransom was an isolated, manual operation by a single attacker. Today, ransomware is an industrialised criminal enterprise conducted by organised groups with dedicated development teams, affiliate programmes, and customer support operations. But the core methodology has not changed: gain access, encrypt or steal the data, destroy the backups, demand payment. The Virginia attacker did manually what REvil, LockBit, and BlackCat do automatically at scale.

The defence against both is the same: prevent initial access through penetration testing and Cyber Essentials certification, detect intrusions early through continuous SOC monitoring, maintain immutable offline backups, and have a tested incident response plan ready for when prevention fails. The organisations that implemented these controls in 2009 were ahead of the curve. The organisations that have not implemented them by 2025 are overdue.


Is your organisation prepared for a ransomware attack?

Our <a href="/penetration-testing">penetration testing</a> identifies the vulnerabilities that ransomware groups exploit. Our <a href="/cyber-essentials">Cyber Essentials certification</a> establishes the baseline controls. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects intrusions before encryption begins. And <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence's incident response service</a> is there when you need it most.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles