INTERLOCK Ransomware Claims Healthcare and Manufacturing Victims

The INTERLOCK ransomware group has added two new victims to its dark web leak site: Apex Spine and Neurosurgery (United States) and Aero Fabrications Limited (United Kingdom). The attack highlights the group's continued cross-sector, international targeting strategy — hitting both healthcare and manufacturing in a single campaign disclosure.

What We Know

Apex Spine and Neurosurgery 🇺🇸

Apex Spine and Neurosurgery is a medical practice specializing in comprehensive neurosurgical care. Healthcare organizations remain prime ransomware targets due to:

• Highly sensitive patient data (PHI) protected under HIPAA
• Critical operational continuity requirements
• Often legacy systems with delayed security updates
• High willingness to pay to restore operations

Aero Fabrications Limited 🇬🇧

Aero Fabrications operates in the precision manufacturing sector, likely serving aerospace and defense supply chains. Manufacturing targets present attackers with:

• Proprietary engineering designs and specifications
• Supply chain intelligence
• Customer/contract data
• Operational technology (OT) system access

About INTERLOCK Ransomware

INTERLOCK is a relatively newer ransomware operation that emerged in late 2024. The group operates on a double-extortion model:

1. Encrypt victim systems — rendering data and operations inaccessible
2. Exfiltrate data — threatening public release if ransom isn't paid

INTERLOCK Technical Characteristics

Unlike ransomware-as-a-service (RaaS) groups that rely on affiliates, INTERLOCK appears to operate as a closed group — maintaining tighter operational security and victim selection.

Healthcare: A Persistent Target

This incident continues the troubling trend of ransomware groups targeting healthcare organizations. Medical practices face unique challenges:

Why Healthcare Is Targeted

• Data value: Medical records sell for 10-40x the price of financial records on dark markets
• Operational pressure: Patient care cannot wait for extended recovery windows
• Compliance liability: HIPAA violations add regulatory pressure beyond ransom demands
• Legacy infrastructure: Medical devices and systems often run outdated software

2025-2026 Healthcare Ransomware Incidents

Manufacturing Supply Chain Risk

Aero Fabrications' inclusion highlights ransomware groups' interest in manufacturing and aerospace supply chains. The stolen data may contain:

Potential Data Exposure

• Engineering specifications: CAD files, technical drawings, tolerances
• Quality documentation: Inspection reports, certifications, compliance records
• Customer data: Contract details, pricing, order histories
• Process information: Manufacturing procedures, proprietary techniques

For aerospace suppliers, data theft extends risk to:

• Defense contractors relying on the supply chain
• Competing manufacturers seeking intelligence
• Nation-state actors interested in technical capabilities

Double-Extortion in Practice

INTERLOCK's listing of both organizations demonstrates the double-extortion playbook:

Timeline typical for double-extortion attacks:

1. Initial access         → Weeks to months before encryption
2. Network reconnaissance → Identify valuable data and systems
3. Data exfiltration      → Copy files to attacker infrastructure
4. Encryption deployment  → Lock systems, drop ransom note
5. Extortion begins       → Pay or data goes public
6. Leak site listing      → Public pressure when victims don't pay

The appearance on INTERLOCK's leak site suggests either:

• Ransom negotiations failed — victims refused to pay
• Proof of compromise — demonstrating stolen data to pressure payment
• Deadline approaching — final warning before full data publication

Implications and Response

For Affected Organizations

Organizations listed on ransomware leak sites should:

1. Assume full compromise — treat all data as potentially exfiltrated
2. Engage incident response — forensics to determine scope and entry point
3. Notify affected parties — patients, customers, partners as required by law
4. Report to authorities — FBI IC3, CISA, and relevant regulators
5. Monitor for data publication — prepare for disclosure scenarios

For Similar Organizations

Healthcare and manufacturing organizations should assess their exposure:

Key Takeaways

• INTERLOCK ransomware listed two new victims: a US healthcare provider and UK manufacturer
• Cross-sector targeting demonstrates opportunistic, international operations
• Healthcare remains vulnerable due to data sensitivity and operational pressure
• Manufacturing supply chains face intellectual property and customer data risks
• Double-extortion makes data protection as critical as backup strategies

Protecting Against Ransomware

Traditional defenses focus on preventing initial access and maintaining backups. But in the era of double-extortion, preventing data theft is equally important:

• Network segmentation — limit what attackers can access post-compromise
• Data classification — know where sensitive information resides
• Encryption at rest — ensure stolen files are unusable without keys
• Zero-trust architecture — verify every access request
• Endpoint detection — catch encryption attempts early

The organizations affected by INTERLOCK face difficult decisions ahead. For others, this incident is a reminder that ransomware preparedness must address both operational recovery and data exposure scenarios.

Need to ensure your sensitive data remains protected even when attackers gain access? Learn how CIFER's encryption architecture keeps data secure regardless of infrastructure compromise.