{"id":971,"date":"2024-10-25T13:05:11","date_gmt":"2024-10-25T19:05:11","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/?p=971"},"modified":"2024-10-25T15:15:04","modified_gmt":"2024-10-25T21:15:04","slug":"ascension-healthcare-yet-another-crippling-ransomware-attack","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/2024\/10\/25\/ascension-healthcare-yet-another-crippling-ransomware-attack\/","title":{"rendered":"Ascension Healthcare: Yet Another Crippling Ransomware Attack"},"content":{"rendered":"\n

Hospitals and other healthcare organizations has been a lucrative target for threat actors since the dawn of ransomware attacks. This is primarily due to the volume of sensitive information stored in hospitals like Patients personal information, their medical records and access to diagnostic devices. Some of the industry experts believe that a patients medical and personal data is worth 10 times [1]<\/sup> over their credit card information to the hackers. And the latest victim on the market is \u2018Ascension Healthcare.\u2019<\/p>\n\n\n\n

Ascension is one of the largest health systems in the United States with over 142 hospitals operating in 19 states and District of Columbia.[2]<\/sup><\/sup><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On May 9, 2024, Ascension released a public statement that the company detected unusual activity on select technology network system on May 8, 2024, which they believed was a potential cybersecurity event. They also mentioned: \u201cOur care teams are trained for these kinds of disruptions and have initiated procedures to ensure patient care delivery continues to be safe and as minimally impacted as possible. There has been a disruption to clinical operations, and we continue to assess the impact and duration of the disruption.<\/em>“[3] <\/sup>But we are about to learn how much the care team struggled to keep patients alive. <\/p>\n\n\n\n

How did it Start?<\/strong><\/p>\n\n\n\n

All it took was one email to bring an entire hospital system down. Apparently, an employee at one of Ascension hospitals in Michigan accidentally downloaded a malicious file, mistaking it for a legitimate document. In a media statement from Ascension on June 12, 2024, they clarified that employee accidentally downloaded that malicious file and that was anything but an \u2018honest mistake\u2019.[3]<\/sup> A mistake that allowed the attackers to hack into seven of the hospital systems 25,000 servers resulting in a week-long cyber-attack.[4]<\/sup> CNN reported that the type of ransomware used in this hack contains the signature of a broad criminal group called \u2018Black Basta\u2019. They are known for their accelerated attacks against healthcare sector with at least two other health care organizations in Europe and US affected in the last month causing \u2018Severe Operational Disruptions.\u2019 [5]<\/sup><\/p>\n\n\n\n

The exact origin of the \u2018Black Basta\u2019 group is still unclear, but there are several indications that the group operates out of Eastern Europe with some ties to Russian cybercriminal networks. It operates as a closed ransomware-as-a-service (RaaS) group and some of the most popular threat actors in their groups includes Storm-1811 and FIN7.[11]<\/sup> You can read more about their strategy and infiltration techniques here: Storm-1811<\/a> | FIN7<\/a>.<\/p>\n\n\n\n

 Day of the Attack:<\/strong><\/p>\n\n\n\n

Ascension had to pull something out of their playbook to ensure critical patient needs are addressed as soon as they became aware of the incident. Standard operating procedures in such situations includes:<\/p>\n\n\n\n