Brian Krebs of KrebsonSecurity.com posted an in-depth article about a UK Hospital System that has been crippled by a computer virus. This cybersecurity breach has forced multiple hospitals to cancel surgeries and divert trauma patients and “at risk” women in labor. Although no information was released about what kind of computer virus infected the Hospital systems, it is likely an infestation of ransomware — a malware scourge whose purveyors have taken to targeting hospitals and healthcare facilities.
Ransomware scours an infected computer for documents, audio files, pictures and other things likely to be of value to the system’s owner, and then encrypts that data with very powerful encryption software. Most ransomware variants also scour the local network for other systems or network shares to infect. Victims usually can only get their files back after paying a specified ransom demand using a virtual currency, such as Bitcoin.
Ransomware attacks have been increasingly used by cyber criminals to blackmail individuals and businesses, as we’ve previously discussed here and here.
Brian’s article also provides some history leading up to this latest intrusion:
“Earlier this year, experts began noticing that cybercriminals were using ransomware to target hospitals — organizations that are heavily reliant on instant access to patient records. In March 2016, Henderson, Ky.-based Methodist Hospital shut down its computer systems after an infection from the Locky strain of ransomware. Just weeks before that attack, a California hospital that was similarly besieged with ransomware paid a $17,000 ransom to get its files back.
According to a recent report by Intel Security, the healthcare sector is experiencing over 20 data loss incidents per day related to ransomware attacks. The company said it identified almost $100,000 in payments from hospital ransomware victims to specific bitcoin accounts so far in 2016.”