Hospital Ransomware Attacker Receives 70 Month Jail Term

Posted by Steve Alder

A Ukrainian affiliate of the Nefilim & Hive ransomware operations who attacked hospitals, government entities, and businesses over a three-year period has received a 70-month jail term. Ukrainian national Artem Aleksandrovych Stryzhak, 35, was arrested in Spain in June 2024 and was extradited to the United States on April 30, 2025, to face charges of alleged involvement in the Nefilim and Hive ransomware operations. Co-conspirator, Ukrainian national Volodymyr Tymoshchuk, was also indicted but remains at large. An $11 million reward has been offered by the U.S. Department of State for information that leads to his arrest.

Stryzhak was alleged to have joined the Nefilim ransomware operation as an affiliate in June 2021, and agreed to pay the ransomware operator 20% of any ransom payments he generated in exchange for access to the Nefilim group’s infrastructure and encryptor. Between June 2021 and October 2021, Stryzhak used Nefilim ransomware in multiple attacks on entities in the United States.

Stryzhak was also alleged to have been a member of the Hive ransomware operation between June 2021 and January 2023, and along with his co-conspirators, conducted attacks on hospitals, government entities, and businesses. According to the prosecutors, along with his co-conspirators, Stryzhak deployed Hive ransomware against seven victims, including law firms, a dentist’s office, and a healthcare provider during the COVID-19 pandemic.

Stryzhak pleaded guilty to conspiracy to commit fraud and related activity such as extortion in connection with international ransomware operations and faced up to 10 years in jail. At sentencing in federal court in Brooklyn on October 27, 2026, Stryzhak received a 70-month prison term. “Artem Stryzhak chose to deploy ransomware that extorted money from victims, leaving businesses and individuals facing devastating losses.  His actions serve as a strong reminder of the real-world damage cybercriminals can cause and underscore the FBI’s commitment to stopping these schemes and protecting the public,” stated FBI Assistant Director in Charge Barnacle.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The post Hospital Ransomware Attacker Receives 70 Month Jail Term appeared first on The HIPAA Journal.

More Than One-Fourth of Healthcare Websites Fail Core Privacy Tests

Posted by Steve Alder

A recent study conducted by Datatrue on the most visited U.S. websites found that more than 4 in 10 websites failed its core privacy tests. The study was conducted on the top 242 most visited U.S. websites between October 12 and 13, 2026. The websites spanned several sectors, including 50 healthcare websites. Datatrue found a clear gap between what website visitors are offered in terms of privacy and what they are provided.

For the study, Datatrue assessed each of the websites three times with the Global Privacy Control (GPC) signal switched on. This is a browser setting that instructs websites that the visitor does not want to have their data sold or shared. Datatrue assessed whether there was any ad tracking – the sending of visitor data to ad tech firms, social media companies, or audience data or ID companies; whether there was a clear option available to website users to opt out of tracking, such as “reject all” or “only accept essential” tracking options; and if session replay was started upon landing on the site. Session replay records clicks and scrolls before the visitor has made any choice, allowing the site owner to replay the visit later.

Across all sectors represented in the study, healthcare performed best overall for website visitor privacy, with the lowest levels of ad tech. Healthcare websites had a median of 1.5 ad companies per site and the lowest percentage of sites (28%) failing Datatrue’s core data privacy tests. The next best sector was media with a 40% failure rate. Healthcare sites also had the second-lowest rate of session replay on arrival (18%), ahead of media (12%)

The study found that while hospital sites had low levels of ad tech, they often failed to respect visitor choices. Out of the 50 sites, 18 were found to contact ad or social media companies before visitors were given a choice. Out of those 18 sites, 14 did nothing when GPC was switched on, 2 sites cut some of the tracking, and only 2 sites stopped all tracking. With only a 7% drop in ad domains with GPC enabled, healthcare performed worst out of all sectors.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Similar to other sectors, healthcare performed poorly for failing to provide web visitors with an obvious opt-out option. Out of the 50 healthcare sites, 32 had no opt-out option, 7 had an opt-out option that wasn’t obvious, and 11 had an obvious opt-out choice. Out of the 50 sites, 9 started session replay on arrival before giving visitors a choice.

The study confirmed that perfect user privacy is possible, although it is rare, as only 3 sites out of the 242 tested passed all core privacy tests. Respecting visitor privacy matters as regulators have started to take action, with California having imposed financial penalties for privacy failures. Datatrue recommends giving visitors a clear choice on-screen upon site arrival; ensuring that every tag that shares or sells data is switched off if GPC is enabled; holding session replay until consent is given by a visitor; removing any ad tracking code that is no longer used; and testing what a page sends when a visitor rejects tracking to make sure that their choice is honored.

The post More Than One-Fourth of Healthcare Websites Fail Core Privacy Tests appeared first on The HIPAA Journal.