Ransomware attacks have been steadily increasing in the healthcare industry since the beginning of the year, and with the most recent attacks on Kansas Heart Hospital, it doesn't look like the target placed on these providers will be shrinking anytime soon. Hospitals are recognizing the threat and are making cybersecurity a top priority. But as cybercriminals gain intelligence - and confidence - it may not be enough to make up for human error, outside vendors and other vulnerabilities.
Read the Analysis: Hollywood Presbyterian hack signals more ransomware attacks to come.
Kansas Heart Hospital became the victim of a ransomware attack in May, and after it paid the first one, attackers boldly demanded a second ransom to decrypt data. Kansas Heart Hospital president Greg Duick, MD told local media that patient information was not endangered and routine operations weren't affected. He declined to say how much money Kansas Heart Hospital paid the cybercriminals, only that it was “a small amount.” Duick explained that Kansas Heart Hospital did not pay the second ransom request and said that along with consultants it didn't think that would be a wise move, even though attackers still appear to have some of their data locked.
San Diego-based Alvarado Hospital Medical Center became the third hospital owned by Prime Healthcare Services to be hit with ransomware in March. The system was hit by a "malware disruption" on March 31, the San Diego Union-Tribune reported. A spokesperson for the 306-bed hospital confirmed the cyberattack, but wouldn't say which systems had been affected. For its part, Alvarado said it had taken "extraordinary steps to protect and expeditiously find a resolution to this disruption," according to a statement provided to the Union-Tribune, but offered little other detail except to say patient and employee records hadn't been compromised.
King's Daughters' Health in southeast Indiana had to power down all of its computer systems in March, as it discovered a single employee's file had been infected with Locky ransomware virus. King's Daughters' Health officials told Indiana's WSCH radio that patient data was secure and hadn't been compromised and that it would restart its computer systems once it was safe to do so. KDH used manual processes to continue operations, while the systems were down. Linda Darnell, the hospital's senior director of IT, told the station that ongoing staff education about these evolving cyber threats helped employees act quickly to contain the Locky virus once it was found.
Special report: Ransomware to get worse, hackers targeting whales, IoT triggers new vulnerabilities
March proved to be a big month for ransomware, as MedStar Health in Washington, DC was hit with ransomware that locked down the system for a few days. The cybercriminals demanded a ransom of 45 Bitcoin, or about $19,000 to unlock the system's data. They also offered a separate option of paying 3 Bitcoins to unlock a single computer. The virus affected Washington’s Georgetown University Hospital and other medical offices in the region. MedStar employees encountered a pop-up message demanding the payment in exchange for a digital key that would unlock the data, according to several reports. Medstar said in a statement that the virus prevented some employees from logging into system, but all of its clinics remained open and functioning. The malware blocked MedStar employees from accessing patient data and, in some cases, patients were turned away.
Two Prime Healthcare hospitals in California - Chino Valley Medical Center in Chino and Desert Valley Hospital in Victorville - were attacked by hackers demanding a ransom in March. Prime spokesperson Fred Ortega acknowledged the attack, according to reports and said that neither hospital paid the ransom and no patient data was compromised.
Methodist Hospital in Henderson, Kentucky was held under a ransomware attack for five days in March, which it effectively fended off without paying the cybercriminals. During the attack, the hospital declared an internal state of emergency and posted this to the hospital's website: “Methodist Hospital is currently working in an Internal State of Emergency due to a Computer Virus that has limited our use of electronic web based services. We are currently working to resolve this issue, until then we will have limited access to web based services and electronic communications.”
Attackers broke into Ottawa Hospital’s network with ransomware that initially encrypted four computers. Hospital officials publicly stated that its IT staff has since wiped the machines clean, restored necessary data through backup copies and added that none of the other 9,800 computers were affected and no patient data was compromised. The ransomware attack against Ottawa Hospital is the latest in a string of cybercriminal attempts to gain access to hospital computers then lock down that data and demand payment, typically in Bitcoin, to decrypt it.
Hackers launched a ransomware attack against Hollywood Presbyterian Medical Center and held the hospital’s data hostage until the organization paid the ransom of $17,000 or 40 Bitcoins. Without access to their systems, Hollywood Presbyterian caregivers fell back on handwritten notes and faxes, as the hackers knocked the provider offline for almost a week in February. Everything from e-mails to CT scans were affected, and patients had to pick up prescriptions and test results in person, as they could not be sent electronically because of the emergency.
Ransomware attacks have been steadily increasing in the healthcare industry since the beginning of the year, and with the most recent attacks on Kansas Heart Hospital, it doesn't look like the target placed on these providers will be shrinking anytime soon. Hospitals are recognizing the threat and are making cybersecurity a top priority. But as cybercriminals gain intelligence - and confidence - it may not be enough to make up for human error, outside vendors and other vulnerabilities.
Read the Analysis: Hollywood Presbyterian hack signals more ransomware attacks to come.