Three and a half years ago, Springhill Medical Center in Mobile, Alabama became the target of Russian cybercriminals known as the Ryuk gang and Wizard Spider. Hackers locked up all hospital computers, medical records, and equipment when Springhill refused to pay a ransom.
It is one example among hundreds in the last three years of cyber hackers attacking hospitals and medical centers unsuspectingly knowing that if the systems in those hospitals are down, lives could be lost.
“These criminal groups have been deploying ransomware against these hospitals, trying to lock down data, in some cases locking up medical devices to cause life-threatening conditions that they believe would make these organizations much more likely to pay a quick ransom and make them make money,” explains Dmitri Alperovitch, founder of the Silverado Policy Accelerator.
“It’s really been an epidemic over the past three years with a variety of rural hospitals, small organizations and large hospital networks that have been continuously attacked by these groups and in some cases have had to pay hundreds of thousands of dollars in ransom. . .”
LAWMAKERS CONCERNED ABOUT CHINESE DRONES IN RESTRICTED SPACES AROUND THE CAPITOL
Now the country’s top cyber defenders plan to make protecting hospitals and schools their priority in the new year.
“We call these target entities cyber-poor rich,” explained CISA Director Jen Easterly in an exclusive interview.
CISA, the Cybersecurity and Infrastructure Security Agency established to protect America’s election infrastructure, now focuses on protecting the nation’s water, power grid, and infrastructure. Easterly is a former Army intelligence officer who helped establish US Cyber Command at the NSA. Before that, he hunted down terrorists using cyber tools in Iraq and Afghanistan.
“We’ve seen massive attacks on K-12 schools and hospitals and all kinds of small businesses, which are really the engine of the American economy,” Easterly explained. “What we want to do is make sure that these entities, who don’t have a lot of resources, have the tools, the resources, the capabilities and the information to be able to protect themselves.”
In the past three years, cyberattacks on hospitals have increased, threatening patient information and access to care, and even leading to some deaths. The average cyberattack on healthcare systems has left patients unable to receive some form of care for 19 days, according to data from the CyberPeace Institute.
The CyberPeace Institute has documented 272 cyberattacks against the US healthcare sector, averaging 2.3 per week over a two-year period beginning in mid-2020.
IN FIGURES: CYBER ATTACKS ON US HEALTH CARE SYSTEMS, JUNE 2020 TO SEPTEMBER 2020
37 hospitals
68 specialist doctors
22 clinics
26 care providers
21 mental health and substance abuse facilities
2 ambulance services
8 laboratories and diagnostic centers
14 medical manufacturers
14 pharmaceuticals
1 national health system
16 manufacturing and medical development
CISA recently signed a memorandum of cooperation with Ukraine, whose cyber defenders have been fending off Russian attacks on their critical infrastructure for nearly a decade.
Twitter of the Ukrainian Ministry of Defense is displayed on the screen of a mobile phone on February 15, 2022. Ukraine has had to put up with Russian cyberattacks for years.
(Beata Zawrzel/NurPhoto via Getty Images)
“The Russians have been using the Ukrainians as their cyber sandbox for ten years,” Easterly said. “And they’ve gotten really good. And I think that’s a lesson for us to learn as Americans. We’re going to help them with capacity building around things like industrial control systems. I think there’s a lot we can learn from.” . Ukrainians because they have done a tremendous job and have shown incredible resilience in their infrastructure.”
The Russians started launching cyberattacks in Ukraine in 2014.
“They were honing their skills and at the same time Ukraine was honing their defensive skills. And that gave them practice and an understanding of how the Russians operate,” Easterly explained.
LINDSEY GRAHAM CALLS ON BIDEN TO SUPPLY ‘MODERN HEAVY TANKS’ TO UKRAINE FOR WAR AGAINST RUSSIA
Shortly after Russian troops invaded Ukraine on February 24, 2020, Russia carried out a cyberattack on Ukrainian communications by targeting ViaSat, the American communications company that provided the satellite modems used by the Ukrainians.
Ukraine turned to Elon Musk, who provided Starlink terminals that gave Ukraine the ability to continue to communicate. More recently, the attacks have been called “wiper attacks,” malicious code that only tries to wipe data on a machine, according to cyber expert Alperovitch.
“I think in many ways, because of the high-paced operations that the Russians have been trying to run in the Ukraine, they haven’t been able to stop and plan for something that is much more complicated and would take months to plan.” because they’re probably getting a lot of internal pressure to get things out there for some kind of effect,” Alperovitch said.
“But in previous years, for example, in 2015 and 2016, they executed very complex operations against the Ukrainian power grid, cutting power to hundreds of thousands of homes for a few hours simply through cyber operations. So, in many ways, They have been able to do these kinds of experiments using the Ukrainian networks effectively as a testing platform.”
A person works on a computer during the 10th International Cybersecurity Forum in Lille on January 23, 2018.
(Philippe Huguen/AFP via Getty Images)
Then there was the famous Russian NotPetya attack that began in 2017, targeted Ukraine and spread across the globe to become the most destructive cyberattack in history, according to the White House.
“NotPetya was fake ransomware. It posed as ransomware that would try to lock your data and then demand a ransom to unlock it,” Alperovitch explained. “But of course there would be no way to unlock the data.
“It would destroy it permanently, and it took advantage of what’s known as a supply chain vulnerability because instead of breaking into numerous companies, one by one, the Russians managed to escalate by initially breaking into a company that provided tax filing software.” for Ukrainian companies to make electronic tax declarations”.
Through a malicious update to that software, they were able to infect numerous companies. Many of the Ukrainian companies also had Western subsidiaries and contractors. The virus quickly spread beyond Ukraine’s borders, causing billions of dollars in damage.
CLICK HERE TO GET THE FOX NEWS APP
“Many had to rebuild their networks from scratch. A company like Maersk, for example, a global shipping giant, their networks were completely down. So, they had to rewrite and rewrite to track their ships and their shipments, causing huge complications and massive damage,” Alperovitch explained.
“There were other major manufacturers like Merck and others who were also affected as a result of this attack. So they had to go back up and restore their data because it was basically irreversibly destroyed at that point.”
The Russian government paid no price for that attack.
