Patient Care at Risk as Hospitals Increasingly on Frontlines of Ransomware Attacks

Nurses care for a patient in the intensive care unit in a file photo. Justin Sullivan/Getty Images

A surge of ransomware attacks at hospitals across America are posing a serious risk to both important hospital infrastructure and patient care, according to industry leaders and cybersecurity experts.

On Wednesday, University of Vermont Medical Center President and COO Stephen Leffler testified before a congressional panel on how a ransomware attack in October 2020 placed the medical facility in a state of crisis.

“We didn’t have a phone system, because our phone is on the internet,” Mr. Leffler said at the hearing. “We literally went to Best Buy and bought every walkie-talkie they had and I asked administrators all to run lab results to the floor. Our critical lab results system was down. On day two, we had a pile of paper lab results in our pathology conference room about six inches thick.”

“I’ve been an emergency medicine doctor for 30 years. I’ve been a hospital president for four years. The cyberattack was much harder than the pandemic by far.”

Mr. Leffler said the hospital had to spend $65 million to recover from the ransomware attack. It has since upgraded its IT system by segmenting it into smaller pieces to prevent actors from spreading throughout the entire system in the event of another incident and adding multi-factor authentication.

“We assume a security incident is going to happen again … There are so many people trying,” Mr. Leffler said.

In a ransomware attack, a piece of malicious software paralyzes a computer or entire system until a sum demanded by the hackers is paid.

A report from Malwarebytes Threat Intelligence shows 1,900 total ransomware attacks within just four countries—the U.S., Germany, France, and the U.K.—from July 2022 to June 2023, with the United States attracting 43 percent of all global attacks. Further, in recent years, a growing number of attackers appear to be focusing on hospitals, with hackers demanding higher payments for the return of data.

Brett Callow, a threat analyst with cybersecurity provider Emsisoft, told The Epoch Times that due to the centralization inherent in the digital age, medical facilities have been left especially vulnerable.

“Pretty much everything in a hospital is computer controlled, from patient records to emergency dispatch systems to payroll systems,” said Mr. Callow. “So when the computers go down, that means it’s back to pen and paper, which can just instantly cripple an institution trying to save lives.”

Hospitals have become an especially attractive target due to the urgency in needing to resume life-saving care, according to Mr. Callow.

Cybersecurity expert Brett Callow at a tech panel event. Brett Callow

“In a lot of cases, hospitals had to redirect ambulances and instead take them to the next nearest hospital. For a stroke or heart attack victim, those extra minutes could be the difference between life and death,” said Mr. Callow.

A 2021 lawsuit in Alabama alleged that a newborn’s death resulted from a ransomware attack that took the hospital offline for more than a week.

The bad actors who create ransomware software are usually based in Russia or Eastern Europe, while the ones who use the software to carry out the attacks can be anywhere.

‘Game of Whack-a-Mole’

Network segmentation, which decreases the ability for a cyberattack to take down an entire system through entering one computer, has been shown to be an effective measure, according to Mr. Callow.

“It would be like locking the interior doors of the house so a burglar would have trouble moving from one room to another,” said Mr. Callow.

However, due to the nature of the threat, no security protocol has proven completely effective.

“It’s a constant game of whack-a-mole. It is impossible to completely defend against. No matter how good your defense is, once in a while, the opposition is going to be able to score a goal,” said Mr. Callow. “All you can do is try to reduce the likelihood.”

Rep. Nancy Mace (R-S.C.) has identified the threat of ransomware as “extremely urgent” in introducing legislation that would remove hurdles for qualified cybersecurity professionals to be able to fill posts needed to protect large institutions.

“I’m concerned that we as a nation are not prepared for the increasingly cyberattacks that will be fielded by AI,” Rep. Mace said Wednesday at the joint hearing focused on combating ransomware attacks.

“We’ve got a shortage across the country of 700,000 cyber security professionals with job vacancies shooting across the public and private sector. We need all hands on deck to fill the gap.”

“The government can’t be turning away people with much-needed cyber skills just because they don’t have a four-year degree,” added Rep. Mace.

Rep Nancy Mace (R-S.C.) speaks with reporters in Washington on Oct.21, 2021. Anna Moneymaker/Getty Images

However, no matter how much cybersecurity is employed, ransomware crimes are certain to continue until the incentives are removed that make the criminal act possible, according to Mr. Callow.

“The reason there are increasing numbers of these ransomware attacks is that they are profitable,” said Mr. Callow. “The less profitable they become, the less there will be, and if people stop making payments, there will stop being ransomware attacks.”

However, as long as hospitals and institutions continue issuing millions of dollars in payments to ransomware companies, people can expect large hackers to become an increasingly dominant part of modern society.

“In the short term, putting an end to the payments would mean a lot of pain for large institutions, but in the long run, it may be the only way to put an end to these attacks,” said Mr. Callow.