US hospital systems facing 'imminent' threat of cyber-attacks, FBI warns

An alert said malicious groups are targeting the healthcare sector with attacks designed to lock up information systems and steal data.

The FBI warned that the US healthcare system is facing an ‘imminent’ cybercrime threat. Photograph: J David Ake/AP

–

By Guardian staff and agencies
2020 Oct 30
–
Federal agencies have warned that the US healthcare system is facing an “increased and imminent” threat of cybercrime, and that cybercriminals are unleashing a wave of extortion attempts designed to lock up hospital information systems, which could hurt patient care just as nationwide cases of Covid-19 are spiking.In a joint alert on Wednesday, the FBI and two federal agencies warned that they had “credible information of an increased and imminent cybercrime threat to US hospitals and healthcare providers”. The alert said malicious groups are targeting the sector with attacks that produce “data theft and disruption of healthcare services”.

The cyber-attacks involve ransomware, which scrambles data into gibberish that can only be unlocked with software keys provided once targets pay up. Independent security experts say it has already hobbled at least five US hospitals this week, and could potentially affect hundreds more.

The offensive by a Russian-speaking criminal gang comes less than a week ahead of the election, although there is no immediate indication they were motivated by anything but profit.

–

“We are experiencing the most significant cybersecurity threat we’ve ever seen in the United States,” Charles Carmakal, chief technical officer of the cybersecurity firm Mandiant, said in a statement.

Alex Holden, CEO of Hold Security, which has been closely tracking the ransomware in question for more than a year, agreed that the unfolding offensive is unprecedented in magnitude for the US, given its timing in the heat of a contentious presidential election and the worst global pandemic in a century.

The federal alert was co-authored by the Department of Homeland Security and the Department of Health and Human Services.

The US has seen a plague of ransomware over the past 18 months or so, with major cities from Baltimore to Atlanta hit and local governments and schools hit especially hard.

In September, a ransomware attack hobbled all 250 US facilities of the hospital chain Universal Health Services, forcing doctors and nurses to rely on paper and pencil for record-keeping and slowing lab work. Employees described chaotic conditions impeding patient care, including mounting emergency room waits and the failure of wireless vital-signs monitoring equipment.

Also in September, the first known fatality related to ransomware occurred in Duesseldorf, Germany, when an IT system failure forced a critically ill patient to be routed to a hospital in another city.

Holden said he alerted federal law enforcement on Friday after monitoring infection attempts at a number of hospitals. He said the group was demanding ransoms well above $10m per target and that criminals involved on the dark web were discussing plans to try to infect more than 400 hospitals, clinics and other medical facilities.

“One of the comments from the bad guys is that they are expecting to cause panic and, no, they are not hitting election systems,” Holden said. “They are hitting where it hurts even more and they know it.”

Carmakal described the eastern European group as “one of most brazen, heartless, and disruptive threat actors I’ve observed over my career”.

The cybercriminals launching the attacks use a strain of ransomware known as Ryuk, which is seeded through a network of zombie computers called Trickbot that Microsoft began trying to counter earlier in October.

While no one has proven suspected ties between the Russian government and gangs that use the Trickbot platform, Holden said he has “no doubt that the Russian government is aware of this operation – of terrorism, really”. He said dozens of different criminal groups use Ryuk, paying its architects a cut.

––