Hospital Hackers Seize Upon Coronavirus Pandemic
WASHINGTON — In the midst of the coronavirus pandemic, staffers at the Champaign-Urbana Public Health District in Illinois got an unwelcome surprise when they arrived at work one morning last month: Cybercriminals had hijacked their computer network and were holding it hostage.
The hackers were demanding a ransom to restore the system.
“Our website was pretty much down for three entire days, and it was the primary mode of communicating with the public about COVID-19,” deputy administrator Awais Vaid recalled. “The only good thing was that just a few months before, we had put our electronic medical records and our email on the cloud, so they were not affected.”
The district agreed to meet the hackers’ demands because it didn’t have the time to wait or restore its system on its own, which could have taken months, Vaid said. Its cyber insurance paid more than $300,000 in ransom, and the district had to cover its $10,000 deductible.
“We have become easy targets,” Vaid said. “Agencies like ours have to have systems up and running, otherwise we won’t be able to function. And we needed to be back online as soon as possible because we are the lead authority for public health during this crisis.”
Since the coronavirus pandemic began, cybersecurity experts say they have seen an uptick in attempted ransomware and other hacking attempts on hospitals, health care systems, clinical labs and research centers.
Many hospital and health care employees who aren’t on the front lines are working at home, sometimes on their own computers, which can be more vulnerable to hackers.
And some hospitals that are quickly deploying virtual health care through telemedicine may not be focusing on cyber protections, said Raj Mehta, a principal at global consulting firm Deloitte who focuses on health care cybersecurity.
“In the rush, a lot of times you don’t think about the implications of security,” Mehta said. “A lot of their security professionals are under water. They don’t have time to do the typical risk assessments.”
Across the globe, cybercrimes against the health care sector have surged during the pandemic, experts say. Hackers are using ransomware, phishing — in which victims unwittingly click on emailed links designed to get personal information — and spear phishing, which is phishing targeted toward a specific person, organization or company. Among the cases:
A nonprofit Rochester, N.Y., health system that operates nine health centers shut down its computer network for days in late February after it was hit by a ransomware strike.
California-based biotechnology company 10X Genomics Inc., which is working to discover antibodies for the coronavirus, was the victim of an attempted ransomware attack in March, according to a recent federal filing. The company said it isolated the source and restored operations with no major day-to-day impact.
Microsoft, in a “first-of-its-kind targeted notification,” warned “several dozens of hospitals” this month about software vulnerabilities discovered in the online systems they use. The company said attackers have been “jumping on the bandwagon.”
The Greater New York Hospital Association this month alerted its members that an “active cybersecurity threat” is exploiting vulnerabilities in some networking technology that could allow remote hackers to access networks.
Meanwhile in Europe, there has been “a significant increase” in attempted ransomware attacks, according to a warning Interpol issued this month to hospitals and other health care organizations. A hospital in the Czech Republic and a London medical research company doing clinical trials for new coronavirus medicines already have been victimized.
Hospitals often lag behind other industries such as financial services when it comes to cybersecurity, experts say. That makes them an ideal target for hackers, especially during a time when they’re focused on the coronavirus. “It’s the perfect storm, in a way,” said Deloitte’s Mehta.
The biggest fear is that if computer networks get locked up or knocked offline, health care workers won’t be able to access important information such as patient medical records and test results.
Mat Newfield, chief information security officer for Unisys, a global technology company, said many employees of health care organizations have been given laptops and are working at home with technology they’re not familiar with, on systems they haven’t been trained on.
“There was such a knee-jerk reaction to getting people home, which was a necessity, but there wasn’t a lot of planning for pandemics,” Newfield said. “A lot of these organizations didn’t have business continuity plans that have been tested. Now they’re open to risks.”
Some health care systems have warned staffers to be prepared for cyberattacks.
At Inova Health System, which runs five hospitals in Northern Virginia, officials are ramping up their usual cybersecurity alerts to staffers, said Scott Larsen, chief information security officer.
Officials have provided employees working at home a secure link to the corporate network and are requiring two-factor authentication to get into it. That means staffers must use a second method of confirming their identity before logging in, such as typing in a one-time password sent to their smartphone or email.
While many health care security professionals are carefully watching and monitoring for any suspect cyberactivity, Larsen said, it’s difficult to deal with both hackers and a pandemic.
“It’s like when your immune system is weak and your defenses are down,” he said. “We’re so distracted, and we’re getting caught looking one way, and they are coming in the other way.”
In Michigan the 157 hospitals that are members of the Michigan Health and Hospital Association also are “at heightened awareness,” said Ruthanne Sudderth, the group’s spokeswoman. Hospitals there have been trying to make sure employees are especially careful about emails they receive.
While hospitals in Michigan have dealt with cyberattacks in the past and will in the future, Sudderth said, this situation somehow seems different.
“Any kind of attack on the institutions that are saving the lives of our loved ones and neighbors is deplorable. That’s the case any time,” she said. “But doing it during a pandemic really shows the true colors of the individuals or organizations behind those sorts of attacks.”
Distributed by Tribune Content Agency, LLC.
In The News
WASHINGTON (AP) — Top national security agencies confirmed Tuesday that Russia was likely responsible for a massive hack of U.S. government departments and corporations, rejecting President Donald Trump's claim that China might be to blame. The rare joint statement represented the U.S. government's first formal attempt... Read More
WASHINGTON (AP) — Once in office, President-elect Joe Biden will punish Russia for its suspected cyberespionage operation against the United States with financial sanctions and measures to hobble the Kremlin's ability to launch future hacks, his chief of staff said Sunday, as a GOP senator criticized President Donald... Read More
WASHINGTON - Rep. Stephanie Murphy, D-Fla., is urging House leadership to schedule a classified, bipartisan briefing for members of Congress regarding the recently revealed cyberattack on the networks of the federal government and major American companies. The attack is widely believed to have been the work... Read More
WASHINGTON -- The federal government's top cybersecurity agency on Thursday issued its most urgent warning yet about a sophisticated and extensive computer breach, saying it posed a "grave risk" to cyber networks maintained by governments, utilities and the private sector and could be difficult to purge.... Read More
The suspected Russian hackers behind a global campaign of cyberattacks that have breached U.S. government agencies also hit an American think tank, according to a cybersecurity firm that has been fighting them off. For the better part of a year, investigators at Volexity have been battling... Read More
WASHINGTON (AP) — U.S. government agencies were ordered to scour their networks for malware and disconnect potentially compromised servers on Monday after authorities learned that the Treasury and Commerce departments were hacked in a global cyber-espionage campaign tied to a foreign government. In a rare emergency directive issued... Read More