The Department of Justice May 7 announced more than two dozen criminal charges against Dimitry Yuryevich Khoroshev, 31, of Voronezh, Russia, for his alleged role as the creator, developer and administrator of the LockBit ransomware group. According to the 26-count indictment and other records previously unsealed by the U.S. District Court of New Jersey, Khoroshev and coconspirators grew LockBit into what was, at times, the most active and destructive ransomware variant in the world. 

LockBit's victims included hospitals, individuals, small businesses, multinational corporations, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies. The group attacked more than 2,500 victims in at least 120 countries, including 1,800 victims in the U.S., and extracted at least $500 million in ransom payments from victims. The cyberattacks caused billions of dollars in broader losses such as revenue, incident response and recovery. 

"The combined efforts by the DOJ, FBI, Treasury and State departments to dismantle and disrupt the notorious and dangerous LockBit ransomware group should be congratulated," said John Riggi, AHA's national advisor for cybersecurity and risk. "Protected cooperation from the victims of LockBit was no doubt essential in the government’s efforts. As we see high-impact ransomware attacks against health care continue to disrupt patient care and pose a broad risk to patient and community safety, it has become clear that any defensive cyber measures imposed upon hospitals must be accompanied by an equally aggressive and sustained offensive strategy by the U.S. government to combat this ongoing and unresolved national security threat. These attacks should be aggressively pursued and prosecuted as such by the federal government. We use the term 'prosecuted' in all senses of the definition related to the totality of the government’s capabilities and authorities, including intelligence and military authorities.” 

For more information on this or other cybersecurity and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber threat intelligence and resources visit www.aha.org/cybersecurity.

Related News Articles

Headline
The Cybersecurity and Infrastructure Security Agency Oct. 15 released an emergency directive advising federal agencies to take stock of their F5 BIG-IP…
Headline
In part one of a new blog, John Riggi, AHA national advisor for cybersecurity and risk, and Scott Gee, AHA deputy national advisor for cybersecurity and risk,…
Perspective
Public
This week, the FBI issued an urgent warning to all users — including hospitals — of a critical security soft spot within Oracle’s E-Business Suite, stating “…
Headline
The Health Sector Coordinating Council Oct. 7 released its Sector Mapping and Risk Toolkit, created to help health care providers and other organizations…
AHA Cyber Intel
As of Oct. 3, 2025, 364 hacking incidents had been reported to the U.S. Department of Health and Human Services Office for Civil Rights, affecting over 33…
Headline
The AHA Oct. 6 released a Cybersecurity Advisory urging immediate action against a critical Oracle E-Business Suite vulnerability that is remotely exploitable…