FBI Warning Healthcare Providers to Prepare for Ransomware Attacks

The FBI is warning hospitals and healthcare providers to brace for a deluge of ransomware attacks…

The Federal Bureau of Investigation (FBI) is warning hospitals and healthcare providers to brace for a deluge of ransomware attacks. The advisory, which was issued jointly with the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS), states that the agencies have “credible information” of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers. The threat of ransomware attacks come as the U.S. healthcare system is already feeling the strain of COVID-19.

According to the advisory, cyber actors are targeting the Healthcare and Public Health (HPH) Sector with TrickBot and BazarLoader malware, often leading to ransomware attacks, data theft, and the disruption of healthcare services. “CISA, FBI, and HHS are sharing this information to provide warning to healthcare providers to ensure that they take timely and reasonable precautions to protect their networks from these threats,” the advisory states.

Precautions to Help Prevent a Ransomware Attack

To be ready to fend off a potential cyberattack, hospitals and other healthcare providers should audit their existing cyber policies and procedures to ensure that they are sufficient. Of course, simply have protocols in place is just the first step; it is also important to verify that employees know how to carry them out and that they work as expected.

Below are a few specific tips:

• Implement a cyber incident response plan: It is of paramount importance that organizations create, maintain, and exercise a basic cyber incident response plan and an associated communications plan that includes response and notification procedures for a ransomware incident.  The development of these plans in conjunction with legal counsel and technology consultants is critical to controlling the organization’s potential liability when attacked. 
• Plan for the loss of critical systems: Because it often takes time to recover from a ransomware attack and restore normal operations, it’s important to plan for the possibility of critical information systems being inaccessible for an extended period of time. As emphasized in the FBI advisory, this should include, but not be limited to, the following: print and properly store/protect hard copies of digital information that would be required for critical patient healthcare; plan for and periodically train staff to handle the re-routing of incoming/existing patients in an expedient manner if information systems were to abruptly and unexpectedly become unavailable; coordinate the potential for surge support with other healthcare facilities in the greater local area.
• Perform regular data backups: It is critical to maintain offline, encrypted backups of data and to regularly test your backups. Backup procedures should be conducted on a regular basis. It is important that backups be maintained offline or in separated networks as many ransomware variants attempt to find and delete any accessible backups. Maintaining offline, current backups is most critical because there is no need to pay a ransom for data that is readily accessible to your organization.
• Update software regularly: Never ignore software updates; it is imperative to quickly patch the operating system, software, and firmware on all computers as soon as manufacturers release updates. Employees should also be instructed to install security updates on all company devices, as well as any personal devices that may be connected to your network. Virus detection programs should also be kept up to date. While it is often easy to ignore software update notifications, failing to stay up to date can not only leave you vulnerable to a cyberattack, but also expose you to liability.
• Conduct cybersecurity training: Well-trained employees can often thwart of cyberattack before it takes down your systems. However, as ransomware attacks become more sophisticated, workers need to be more vigilant. While ransomware attacks initially relied on email messages that were clearly identifiable as spam, hackers are now using phishing schemes that make emails appear to come from a known contact.

Recent Cyberattacks Targeting the Healthcare Industry

Statistics confirm the growing cyber threat to the healthcare sector. According to a recent report by Checkpoint Security, the number of ransomware attacks against U.S. hospitals in October 2020 increased by 71 percent, compared to the previous month. CheckPoint Security also reported a 50 percent uptick in average daily ransomware attacks in the third quarter of 2020, compared to the first six months of the year. In Q3, attacks in the US skyrocketed by 200 percent. 

In September, Universal Health Services suffered a ransomware attack impacting all of its 250 U.S. facilities. Without access to its computer systems, doctors and nurses were forced to use paper and pencil to keep patient records, and laboratory and imaging results were also delayed. Sky Lakes Medical Center in Oregon, the University of Vermont Health Network, and St. Lawrence Health System in New York reported similar incidents in recent weeks. In Germany, a ransomware attack resulted in a patient death. According to media reports, a woman who needed urgent admission died after she had to be transferred to another city for treatment.

CISA, FBI and HHS do not recommend paying ransoms. “Payment does not guarantee files will be recovered. It may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities,” the advisory states. Instead, the agencies emphasize the importance of preparedness. 

Key Takeaway

In light of the growing threat from malicious cyber criminals, it is imperative to review or establish critical cyber procedures, including patching plans, cyber incident response protocols, and business continuity plans. It is critical to involve legal counsel when preparing incident reports and response protocols.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.