Hospital Hackers Seize Upon Coronavirus Pandemic

Read Stateline coverage of the latest state action on coronavirus.

In the midst of the coronavirus pandemic, staffers at the Champaign-Urbana Public Health District in Illinois got an unwelcome surprise when they arrived at work one morning last month: Cybercriminals had hijacked their computer network and were holding it hostage.

The hackers were demanding a ransom to restore the system.

“Our website was pretty much down for three entire days, and it was the primary mode of communicating with the public about COVID-19,” deputy administrator Awais Vaid recalled. “The only good thing was that just a few months before, we had put our electronic medical records and our email on the cloud, so they were not affected.”

The district agreed to meet the hackers’ demands because it didn’t have the time to wait or restore its system on its own, which could have taken months, Vaid said. Its cyber insurance paid more than $300,000 in ransom, and the district had to cover its $10,000 deductible.

“We have become easy targets,” Vaid said. “Agencies like ours have to have systems up and running, otherwise we won’t be able to function. And we needed to be back online as soon as possible because we are the lead authority for public health during this crisis.”

Since the coronavirus pandemic began, cybersecurity experts say they have seen an uptick in attempted ransomware and other hacking attempts on hospitals, health care systems, clinical labs and research centers.

Many hospital and health care employees who aren’t on the front lines are working at home, sometimes on their own computers, which can be more vulnerable to hackers.

And some hospitals that are quickly deploying virtual health care through telemedicine may not be focusing on cyber protections, said Raj Mehta, a principal at global consulting firm Deloitte who focuses on health care cybersecurity.

“In the rush, a lot of times you don’t think about the implications of security,” Mehta said. “A lot of their security professionals are under water. They don’t have time to do the typical risk assessments.”

Hackers Emboldened

Across the globe, cyber crimes against the health care sector have surged during the pandemic, experts say. Hackers are using ransomware, phishing — in which victims unwittingly click on emailed links designed to get personal information — and spear phishing, which is phishing targeted toward a specific person, organization or company. Among the cases:

• A nonprofit Rochester, New York, health system that operates nine health centers shut down its computer network for days in late February after it was hit by a ransomware strike.
• California-based biotechnology company 10X Genomics Inc., which is working to discover antibodies for the coronavirus, was the victim of an attempted ransomware attack in March, according to a recent federal filing. The company said it isolated the source and restored operations with no major day-to-day impact.
• Microsoft, in a “first-of-its-kind targeted notification,” warned “several dozens of hospitals” this month about software vulnerabilities discovered in the online systems they use. The company said attackers have been “jumping on the bandwagon.”
• The Greater New York Hospital Association this month alerted its members that an “active cybersecurity threat” is exploiting vulnerabilities in some networking technology that could allow remote hackers to access networks.

Meanwhile in Europe, there has been “a significant increase” in attempted ransomware attacks, according to a warning Interpol issued this month to hospitals and other health care organizations. A hospital in the Czech Republic and a London medical research company doing clinical trials for new coronavirus medicines already have been victimized.