A hospital in Southern California is currently without access to email, digital patient records, and some internet-connected medical devices following a cyber attack that saw hackers take its computer networks clear offline – before demanding more than $5 million in ransom.
NBC LA reports that an "internal emergency" was declared at the Hollywood Presbyterian Medical Center in Los Angeles after staff began experiencing "significant IT issues" around Feb. 5.
Hospital CEO and president Allen Stefanek confirmed the attack on Friday as both The Los Angeles Police Department and The FBI launched investigations into the case, noting that "the shutdown has not affected patient care."
It has, however, resulted in emergency room delays, 911 patients being diverted to other hospitals, and the need for all registrations and medical records to be written by hand on paper.
Staff members at the private, 434-bed hospital have been speaking to various local news outlets about additional problems caused by the network shutdown, including one unnamed doctor who told NBC4 News that departments are now "communicating by jammed fax lines" because they have no email access.
The doctor also said that computers used for tasks like lab work transmittal, documentation, sharing of X-rays and CT scans have been taken offline, and that some outpatients have missed treatments due to the fallout of this attack.
Patients themselves are being told they must pick up medical test results in person as opposed to having them delivered electronically, according to BBC News.
This example image shows the kind of encryption notice received by users after hackers have used ransomware to take files hostage and demand a payment in exchange for restored access. (phishme.com)
While Stefanek described the attack as random, he didn't expand on the type of malware being used, how the hospital's system became infected, or how much money was being demanded for access to be restored.
Computer forensics expert Eric Robi, whose clients include both the State of California and the U.S. federal government, told FOX 11 Los Angeles that hackers have asked Hollywood Presbyterian Medical Center for approximately 9,000 bitcoin (just over $5 million) in relation to a ransomware attack.
Several employees at the hospital echoed this while speaking to NBC4, reportedly saying that "hackers would send back the key codes to restore the system" in exchange for a bitcoin ransom.
"I don't know why they chose a hospital specifically," Robi said. "It's an unfortunate hack, a ransomware hack where they're asking for money in exchange for unlocking records at the hospital."
After working on half a dozen similar attacks against LA businesses over the past year, Robi said that "most of the time it's cheaper to pay the ransom than to pay to fix the problem" – though he did note that this particular ransom was higher than any he'd seen before.
Ransomware, a form of malicious software that seeks out your computer files and locks them until you pay a fee, is not a new problem among individuals and corporations.
A November CBC News investigation discovered that cyber-crimes of this nature actually dupe Canadians out of hundreds of millions of dollars (potentially up to $1 billion) each year.
Two months ago, The RCMP unveiled a new cybercrime strategy aimed at helping local police deal with cases of malware, fraud and similar online threats affecting Canadians from both domestic and global sources – but law enforcement officials can only do so much when it comes to ransomware in particular, as it stands.
At least two U.S. police departments reportedly paid off cyberthieves last year after days of trying to decrypt locked systems, and many victims don't contact the police at all. They'd rather pay out the money then risk losing their files – especially when those files are of an expensive, irreplaceable, or even life-saving nature.
If @HollywoodPres ends up paying this, they're fueling the problem. @FBICyberCrime , paying attention? #ServerBackup https://t.co/FJ4U1RDNgY
— @bdmccray
What's happening to Hollywood Presbyterian Medical Center may be part of a larger trend predicted for this year by Forrester Research, in which ransomware is being used to target the medical sector.
Forrester's paper, released in November, pegged the primary hacking trend of 2016 as "ransomware for a medical device or wearable," arguing that it would be relatively easy for cybercriminals to target vital health devices and then threaten victims with their own lives for ransom money.
Indeed, many medical devices have been found to have serious cybersecurity flaws.
Motherboard cites a 2013 DHS advisory warning of 300 medical devices with factory-set passwords that cannot be changed by users, but can be discovered by anyone online who downloads the device's manual.
"Medical device ransomware would be a modern form of highway robbery with lives at stake," wrote Motherboard of the Forrester prediction. "Chest pains send you into convulsions, then stop abruptly. Is something wrong with your pacemaker? As you pant for breath, a message pops up on your phone. 'Want to keep living? Pay us a ransom now, or you die.'"
The Hollywood Presbyterian Medical Center investigation is ongoing, FBI spokeswoman Ari Dekofsky told Reuters. She declined to release further details.
0 nhận xét:
Đăng nhận xét