A major ransomware enterprise was disrupted on Thursday as a result of a joint task force operation by the Federal Bureau of Investigation (FBI), Department of Justice (DOJ), US Secret Service (USSS), and other international agencies. Hive Ransomware’s leak sites was seized by authorities and currently displays the statement [translated from Russian] “The Federal Bureau of Investigation seized this site as part of a coordinated law enforcement action taken against Hive Ransomware.” One (1) of the significant reasons Hive Ransomware was targeted for seizure was due to their repeated attacks against hospitals and healthcare centers throughout the world. One (1) attack carried out in Midwestern United States caused a hospital to turn away sick patients after ransomware was deployed on their systems. Another attack didn’t compromise the integrity of hospital systems, but Hive actors exfiltrated sensitive patient data on 270k individuals from hospital systems. According to the DOJ, the FBI had successfully infiltrated Hive systems back in July 2022 and captured decryption keys for over a thousand victims, releasing them for free. This act alone saved victims from paying over $130 million in ransom demands. While Hive Ransomware operations may be disrupted for now, a rebranding or reemergence is predictable alongside minimal disruption of the entire ransomware landscape. CTIX continues to monitor fallout from the Hive Ransomware seizure and will continue to provide additional updates accordingly.