Mass. Hospitals Warned Of Imminent Ransomware Attacks

Hospitals in Massachusetts put federal guidance into action Thursday after law enforcement and cybersecurity agencies warned of "an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers" and urged organizations to defend themselves against new waves of ransomware attacks.

The Massachusetts Health & Hospital Association said its health care providers around the state were actively protecting their information systems using detailed guidance issued from federal officials.

"Hospitals have been on high alert for cybersecurity threats since this crisis began, and we are taking this most recent threat incredibly seriously," the MHA said. "MHA has established a network of healthcare cybersecurity leaders to provide resources to hospitals on an ongoing basis and we will continue to closely monitor any cybersecurity risks prompted by shameless bad actors."

A warning from the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation, and the U.S. Department of Health and Human Services said Wednesday that cybercriminals are seeking to "infect systems with Ryuk ransomware for financial gain" and that dealing with ransomware, data theft and service disruption "will be particularly challenging for organizations within the COVID-19 pandemic."

The Associated Press reported that the cybercriminals behind the attacks "use a strain of ransomware known as Ryuk, which is seeded through a network of zombie computers called Trickbot that Microsoft began trying to counter earlier in October." The attacks have "hobbled" five hospitals in the United States this week, the AP said.

Hospitals were shoring up their cyberdefenses Thursday as National Security Agency Director of Cybersecurity Anne Neuberger, Gov. Charlie Baker, MassCyberCenter Director Stephanie Helm, House Speaker Robert DeLeo and Senate President Karen Spilka offered pre-recorded remarks at the Massachusetts Technology Collaborative's cybersecurity forum, which marked the end of Massachusetts Cybersecurity Month.

Baker and DeLeo specifically mentioned ransomware, which the governor said is "a persistent threat to municipalities."

Neuberger, in pre-recorded remarks, explained how the federal government works to protect critical networks and information systems from malicious actors, and how state-specific forums like Thursday's can help connect local governments and businesses with cybersecurity resources.

"The clock is always ticking in the field of cybersecurity. It's a priority, no matter what business we're in, whether we work in defense, finance, medicine, power, industry, academia or government, whether you're working at home, schooling children online, or driving cars that are connected to the internet," she said. "We live in a world that's interconnected, where vulnerabilities are exploited within hours of discovery, putting our information, and sometimes our livelihoods at risk."

Earlier this month, Helm told the News Service that hackers are taking advantage of the fear around COVID-19 and the uncertainty over the path of the pandemic to make their phishing campaigns -- in which a hacker attempts to get someone to click on a malicious link masquerading as something relevant -- even more successful.

"It's sort of like they smell uncertainty in the air and they're taking advantage of it," she said.

From the end of February through late March, as the pandemic really ramped up in the Northeast, COVID-19-related phishing attacks increased 667 percent, cybersecurity company Barracuda found. That spike led the FBI to warn of pandemic-related phishing attacks and fake emails purporting to be from the U.S. Centers for Disease Control.

Last month, the review site Safety.com said Massachusetts ranked 10th among states in terms of the financial impact of cybercrime. The site said it used data from the 2019 FBI Internet Crime Report and found that Massachusetts residents lost almost $84.2 million to cybercriminals that year and that the average loss of $12,966 per victim was fourth highest in the nation.

Story by Colin A. Young, State House News Service