New Ransomware Threats

June 19th: Five US healthcare providers in Colorado, Boston, New Orleans, New York and California reported ransomware attacks over a period of seven days. The previous week, a healthcare provider in Ohio, NEW Urology paid $75,000 US to recover from a ransomware attack that infected all of their systems.

June 21st: Marin Community Clinics, located in California were hit by ransomware extortionists, shutting down clinic systems for over three days. The clinics recovered only after they paid extortionists an undisclosed amount.

June 26th: A second city in Florida, Lake City paid $500,000 US to recover from a ransomware attack, after being crippled for two weeks. The same week, Key Biscayne, a third Florida city was attacked and eventually paid extortionists $460,000 US.

June 30th: The Nation Municipality, Ontario, a small town located about 70 km east of Ottawa, was hit by ransomware that shut down the city's email and other systems. As of July 8th, their computer systems are still not fully restored.

July 15th: La Porte, a county in Indiana, paid $130,000 US to ransomware extortionists in order to regain access to the county government's email systems and website.

In March, the insurance firm mentioned above reported that the healthcare industry was the most heavily targeted industry in 2018. With respect to ransomware, healthcare organizations were the victim of over double the number attacks last year, 34%, compared with the next most frequent sectors, financial institutions and professional services, each at 12%. Given that entire city governments have recently been held for ransom, the picture may be changing this year. But it is clear that healthcare is still a major target. While ransomware is the subject we are focusing on in this journal post, another targeted attack in healthcare is the theft of employee credentials, giving hackers access to healthcare personal information. In one US-based healthcare organization, employees were hacked three times within a matter of months, the latest resulting in a privacy breach that involved over 14,000 patients.

In April, a two-doctor clinic in Michigan became the first health care provider in the country to permanently close its business due to a ransomware attack. In this case, the physicians decided not to pay the extortionist's ransom, indicating that there was no guarantee the decryption password would work, or that it would not strike again. The report also cited four other health care provider attacks in Minnesota during the first quarter of 2019, including a ransomware attack affecting 40,000 patients.

Many of the above attacks were launched through email containing dangerous links or email attachments. The nature of these phishing attacks are becoming increasingly sophisticated. Carefully crafted messages are being sent to potential victims, which, as we observed recently, are extremely difficult to detect. In June, at least four hospitals in Romania were hit by cyber-attacks using infected email attachments disguised as invoices and plane tickets.

However, phishing is not the only method now being used to deliver ransomware. Recently, an extortionist group breached three commercial managed service providers (MSPs), which use remote software tools to provide IT support for clients around the world. By using the MSP's own remote management software , extortionists delivered ransomware into the MSP's client internal networks. The potential for third party privacy and security breaches by external IT support and EMR service providers is a vulnerability that is frequently overlooked. But is something that medical clinics should be aware of.

Many factors contribute to healthcare being a major ransomware target.

Frequently cited are

• a chronic lack of funding for information security.
• the value of medical data and potential for a privacy breach. Some ransomware variants not only lock up files, but can also threaten to leak personal information to the Internet.
• the impact on quality of patient care if the problem is not rapidly resolved.
• an immediate, lucrative, and difficult to trace financial reward for extortionists if a ransom is paid.

The threat of ransomware in healthcare in Britain is now so serious that on July 2nd, the Institute of Global Health Innovation in London England issued an urgent warning in a white paper submitted to the House of Lords. The National Health Service (NHS), it indicated, is vulnerable to cyber-attack and must take steps "to defend against threats which could risk the safety of patients".

The report cited the impact the WannaCry ransomware attack had on the NHS , which occurred two years ago. In a matter of hours, it forced the cancellation of thousands of appointments, prevented access to patient data and critical services across Britain, and cost the NHS over $150M Cdn to recover. However, the British team observed WannaCry was relatively crude compared to ones that are taking place now. Recent cyber attacks, they indicated, are becoming more sophisticated and focused on the health sector. The authors also noted that these attacks are not specific to just the NHS. Healthcare organizations around the world may be vulnerable. The full text of the white paper can be found here.

British Columbia is not immune to these issues. In British Columbia, the Health Authorities and the Ministry of Health are taking the ransomware threat seriously. Significant efforts have been underway over the past several years to ensure appropriate IT safeguards are in place. This includes raising staff awareness to protect themselves from phishing and social engineering through training and periodic updates.

Ransomware is a serious risk not only in hospitals, but in private medical clinics as well.

Where can BC physicians in clinics turn to for help?

In the meantime, leadership begins with you. Ransomware will not wait to deliver a payload. The time to make sure that your staff are trained, and have basic security measures in place, is now.

Your efforts can make a difference. An example is how Maffi Clinics, a group of plastic surgery clinics in the US that was hit with ransomware in March. Unlike many similar cases, they recovered within hours, thanks to strong security response procedures that were already in place.

Here's some suggestions on how you can get started.

• Implement at least some of our 10 ways to help protect your clinic from ransomware. Doing so will dramatically reduce your risk of becoming a victim. Had the NHS simply done #4 on the list, the WannaCry ransomware attack would likely have been thwarted. And while you are at it, please make sure to read our article on Breach Notification. It's something that you should always consider doing in the event a ransomware attack does takes place.
• The RCMP has additional advice for personal and business owners.
• Take advantage of the resources at Doctors Technology Office, at Doctors of BC. They have some excellent on-line publications, and can provide additional support through their technical centre website, including:
  • Physician Office IT Security Guide.
  • Safeguards 101 IT Security Workshops.
• You may also want to read what the CMPA has to say about ransomware preparedness.
• The BC Government Information Security Awareness website has additional information about phishing and ransomware.

If you need assistance, contact us.

We can help review your current state of readiness, train your staff through virtual or in-person workshops, and provide additional privacy and security resources.