{"id":1574,"date":"2025-01-30T00:30:44","date_gmt":"2025-01-30T07:30:44","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/?p=1574"},"modified":"2025-01-30T00:30:48","modified_gmt":"2025-01-30T07:30:48","slug":"the-growing-threat-of-ransomeware-attack-in-the-health-care-sector-a-case-of-the-mclaren-health-care-hospital-attacks","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/2025\/01\/30\/the-growing-threat-of-ransomeware-attack-in-the-health-care-sector-a-case-of-the-mclaren-health-care-hospital-attacks\/","title":{"rendered":"THE GROWING THREAT OF RANSOMEWARE ATTACK IN THE HEALTH CARE SECTOR \u2013 A CASE OF THE McLAREN HEALTH CARE HOSPITAL ATTACKS."},"content":{"rendered":"\n
\"\"
Computer security and hacking concept. Ransomware virus has encrypted data in laptop. Hacker is offering key to unlock encrypted data for money.<\/figcaption><\/figure>\n\n\n\n

Ransomware attacks in the Healthcare sector has been on the rise in the past few years, and this may be as a result of what is at stake such as life, legacy system, patient record e.t.c<\/p>\n\n\n\n

McLaren Health care hospitals has experienced two ransomware attacks in the space of one year.<\/p>\n\n\n\n

The first rasnsomware attack was last November, the health care network informed at least 2.2 million people that their data had been breached between July and August 2023. The BlackCat Ransomware gang claimed responsibility for the attack. [1]<\/p>\n\n\n\n

Ransomware group ALPHV\/BlackCat took responsibility for the attack at McLaren, claiming they stole data from 2.5 million patients and continue to operate a \u201cbackdoor\u201d on the nonprofit health system\u2019s network, according to Security Affairs.<\/p>\n\n\n\n

The health system launched an investigation to \u201cidentify what, if any, data exposure occurred\u201d and retained cybersecurity experts to assist, according to a McLaren spokesperson. Based on their current analysis, the spokesperson told Healthcare Dive that they see no evidence to support the backdoor claim.[2]<\/p>\n\n\n\n

In less than a year of the BlackCat ransomware attack, another ransomware attack hit McLaren Health care hospitals. Before the disclosure of the attack by McLaren, its employees at McLaren Bay Region Hospital in Bay City have shared a ransom note warning that the hospital’s systems have been encrypted and stolen data will be published on INC RANSOM ransomware gang’s leak site if a ransom is not paid.[4]<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

   Fig 1. McLaren-ransom-note (Thomas Barz)[4]<\/p>\n\n\n\n

Later that week in August of 2024, Mclaren put out a statement on their website “The attack is impacting its information technology systems across the organization\u2019s 13 hospitals, Karmanos cancer centers, surgery centers, and clinics,” the health system said in a statement. “The disruption is expected to continue through the end of August, while cyber forensic investigations are ongoing. The incident is contained, but access to certain McLaren systems remains limited.”[3]<\/p>\n\n\n\n

IMPACT OF THE ATTACK<\/strong><\/p>\n\n\n\n

The impact of any cyber attack is usually outrageous, and when lives are involved is unimaginable.<\/p>\n\n\n\n

The August 2024 ransomware attack at McLaren Healthcare Hospital had the following impacts:<\/p>\n\n\n\n

    \n
  1. Lost Databases:\u00a0<\/strong>As per several\u00a0sources, McLaren lost its patient databases. It advised patients to carry their detailed health information to appointments including medical history and existing medication they are on. The loss of comprehensive information on patients\u2019 medical history, the drugs they may be on and past treatments, is affecting the treatments they are able to safely receive now.

    <\/li>\n\n\n\n
  2. Rescheduled Appointments:\u00a0<\/strong>Several patients reported that their appointments had been rescheduled as result of the cyber attack at McLaren, including those for Cancer treatments.\u00a0

    82-year-old\u00a0Reginald Tidball, a patient at McLaren Karmanos Cancer Center undergoing chemo and radiation for lung cancer said he\u2019s survived cancer multiple times. However, he was disappointed this week as his appointment kept getting rescheduled. Several other similar stories have been coming to light since last week.\u00a0

    Cardiac tests\u00a0have been postponed and radiation therapy appointments have supposedly been cancelled as a fallout of the ransomware attack. Many have apparently been told that without comprehensive documentation the doctors cannot deliver therapies, especially radiation therapies, safely.\u00a0

    <\/li>\n\n\n\n
  3. Employee Woes:\u00a0<\/strong>The attack is also apparently affecting employees\u2019 paycheck. Once the disruptions were identified as a cybersecurity incident, employees were asked to shut off their systems. Staff were given the option to use their Paid Time Off to cover for the days without work or go on unpaid leave. Many\u00a0said\u00a0they feel like they\u2019re being punished for something that\u2019s not their fault.[1]<\/li>\n<\/ol>\n\n\n\n

    CONCLUSION:<\/strong><\/p>\n\n\n\n

    The growing ransomware attacks on the Health care sector needs to be addressed with a robust Cyber incident response plan and continuous security awareness training and tabletop exercises as the Health sector is an easy target for cybercriminal as it has a lot at stake especially lives and would want to do anything to protect and save lives of their patients such paying the ransom to regain access to their system.<\/p>\n\n\n\n

    Standards on how data is stored and accessed on health care systems should be reviewed and better secure ways should be implemented to ensure that the impact and recovery from a cyber attack does not disrupt operational activity especially ones that are critical to patients lives<\/p>\n\n\n\n

    References.<\/p>\n\n\n\n

      \n
    1. https:\/\/www.cm-alliance.com\/cybersecurity-blog\/mclaren-health-care-ransomware-attack-top-updates<\/a><\/li>\n\n\n\n
    2. https:\/\/www.healthcaredive.com\/news\/mclaren-health-care-ransomware-attack\/695646\/<\/a><\/li>\n\n\n\n
    3. https:\/\/www.lansingstatejournal.com\/story\/news\/local\/2024\/08\/17\/ransomware-attack-mclaren-health-care-patients-services-appointments\/74840781007\/<\/a><\/li>\n\n\n\n
    4. https:\/\/www.bleepingcomputer.com\/news\/security\/mclaren-hospitals-disruption-linked-to-inc-ransomware-attack<\/a><\/li>\n<\/ol>\n\n\n\n

      <\/p>\n","protected":false},"excerpt":{"rendered":"

      Ransomware attacks in the Healthcare sector has been on the rise in the past few years, and this may be as a result of what is at stake such as life, legacy system, patient record e.t.c McLaren Health care hospitals has experienced two ransomware attacks in the space of one year. The first rasnsomware attack … <\/p>\n

      Continue reading “THE GROWING THREAT OF RANSOMEWARE ATTACK IN THE HEALTH CARE SECTOR \u2013 A CASE OF THE McLAREN HEALTH CARE HOSPITAL ATTACKS.”<\/span><\/a><\/p>\n","protected":false},"author":668,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1574","post","type-post","status-publish","format-standard","hentry","category-uncategorized","entry"],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Ukamaka Udeaja","author_link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/author\/ukamaka-udeaja\/"},"_links":{"self":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts\/1574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/users\/668"}],"replies":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/comments?post=1574"}],"version-history":[{"count":1,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts\/1574\/revisions"}],"predecessor-version":[{"id":1579,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts\/1574\/revisions\/1579"}],"wp:attachment":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/media?parent=1574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/categories?post=1574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/tags?post=1574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}