It’s unclear if the man taken into custody, Edward Dubrovsky, 54, is being formally accused of being linked to the infamous cybercrime cell. Dubrovsky works with ransomware victims, helping them to pay off criminals to regain access to their data.

The hack, which was revealed earlier this year in a report from Bleeping Computer, is said to have been limited to a legacy server. Oracle denied its cloud environment had been compromised. 

The North Carolina-based health system was allegedly using third-party tracking code on its website that sent sensitive patient data back to tech companies like Facebook, where it was used for advertising. Atrium does not admit to wrongdoing.

The incident happened in 2019, when a third-party debt collector used by the diagnostics company had a hacker inside its network for over 8 months. In total, the incident exposed records from 27.5 million patients to hackers.

A patient of Huntsville Hospital Health System says the hospital was negligent when it failed to protect patient data that was taken by hackers during a breach on a legacy Cerner EHR system. The hospital said the EHR vendor is ultimately responsible. 

It isn’t clear how many scammers are involved in the effort, but health systems across the country are warning their patients to ignore fake messages, many of which offer a “reward” in the form of a “MyChart Medicare Kit.”

Oleksii Oleksiyovych Lytvynenko, 44, was arrested in Ireland in 2023. As part of the cybercrime group linked to the deployment of Conti, Lytvynenko was found to have possessed data from 12 victims. He pleaded guilty to conspiracy to commit wire fraud.