This week, Nubeva Technologies, which develops ransomware-focused decryption tools, published a case study that describes how a small hospital can help debug a malware attack. Ransomware affected their IT systems.
WHY IT IMPORTANT
Nubeva says its LockBit decryption tool was able to successfully recover data and restore healthcare operations after unauthorized access to an unnamed hospital’s network resulted in the deployment of malware. LockBit 2.0.
Serving a large Ohio subway, a 240-bed hospital with 800 employees fell victim to a zero-day vulnerability that allowed cybercriminals to hack into the network and encrypt electronic health records, a service that patient schedules and domain controllers that manage medical devices and systems, the company said.
Consequences for patient care during the attack included increased wait times, overcrowded emergency departments and interruptions in the treatment of critically ill patients.
Nubeva claims its Ransomware Reversal product can decrypt ransomed data without being seen, eliminating the need to pay ransoms to healthcare organizations. According to its case study, the Ohio hospital had strong IT infrastructure, data backup procedures, and cybersecurity training for staff.
According to the report, the hospital reversed the encryption process and was able to quickly restore critical systems and reduce data loss with the LockBit decryption system, which the company says has helped the hospital control costs. of the ransomware incident.
Recovery time is four days, according to the case study. Deployed before the attack, the ransomware platform’s sensors detected anomalous encryption activity and stored file encryption keys in a secure keystore, according to the company’s case study.
Nubeva also announced the launch of its Healthcare-Safety-Net program this week, which aims to provide healthcare organizations that may be vulnerable to LockBit access to its ransomware recovery platform.
TREND TO BIGGER WOMAN
In December, a LockBit ransomware attack on the Hospital for Sick Children in Toronto caused delays in retrieving test results and images, and affected the system. employee attendance and pharmacy.
While the LockBit ransomware team posted an apology and asked the hospital to decrypt it, the hospital said it did not make the ransom payment.
Whether or not to pay a ransom has long been a topic of debate in the healthcare sector. That’s not recommended, according to the US Department of Health and Human Services, the FBI and countless security leaders – but some hospitals will pay a ransom to decrypt files after an attack to gain access to important data.
In 2021, the Health Industry Cybersecurity Coordination Center released a 31-page summary of LockBit and its affiliate program, and the FBI advised healthcare organizations to call the center. central operating the network when an attack occurs and see if the government has a decoder available.
There are times when the government wins, stops the ransomware gangs, and obtains the decryptor.
In January, the FBI announced that a group of international partners had helped them attack and capture the activities of the Hive ransomware. The FBI then provided more than 300 decryption keys to hacked victims and more than 1,000 keys to previous victims.
ON PROFILE
“Ransomware attacks have become an unfortunate reality for all organizations,” said Nubeva researchers in the case study. “In particular, healthcare organizations have become a prime target for cybercriminals, due to the sensitive nature of the data they process and the critical services they provide.”
In addition to LockBit, ransomware groups like BlackCat, Black Basta, and ClOP, “are relentlessly targeting healthcare organizations,” added Steve Perkins, CMO at Nubeva.
Andrea Fox is the senior editor of Healthcare IT News.
Email: [email protected]
Healthcare IT News is a publication of HIMSS Media.
