Epworth HealthCare Faces Alleged Data Breach by 0APT Ransomware Group Epworth HealthCare, Victoria’s largest not-for-profit healthcare provider, is investigating claims by the 0APT ransomware group that it stole nearly a terabyte of sensitive data. The hackers, who emerged in late January, allege they accessed patient records, surgical documents, billing details, and personal information, totaling 920 GB. In a February post, 0APT warned Epworth against involving external cybersecurity agencies, threatening to leak samples to local media if negotiations were not handled directly. Epworth has denied any confirmed breach, stating that its systems remain secure and operational. A spokesperson confirmed the organization is aware of the unverified report but has found no evidence of compromise after engaging specialist partners. Patient care across Epworth’s Melbourne and Geelong hospitals continues unaffected. 0APT, which markets itself as a "politically neutral" ransomware-as-a-service operation, claims to seek financial compensation rather than business disruption. The group is actively recruiting affiliates, offering a revenue-sharing model for successful attacks. However, its legitimacy remains disputed. Cybersecurity firm Red Piranha identified technical similarities between 0APT’s malware and the 2021 Haron ransomware, noting a hybrid encryption scheme using Salsa20 and RSA-1024. Meanwhile, threat intelligence tracker Ransomware.live has dismissed the group as unreliable, citing unverified victim claims and removed its entries from monitoring. This incident follows a separate ransomware claim in 2023, when the Global group alleged it stole 40 GB of Epworth data an accusation the healthcare provider later attributed to a third-party vendor. 0APT has set a February 6 deadline to publish the alleged stolen data, though no ransom demand has been disclosed. Epworth, which serves over 230,000 patients annually, maintains that its internal investigations have found no indicators of compromise.