Hospital Ransomware Attacks on the Rise

According to a major cybersecurity firm, hospital ransomware attacks are increasing, and health care facilities such as hospitals are a favorite target.

According to the report from Emsisoft, over 620 government agencies, clinics and hospitals and educational institutions were the victims of ransomware attacks between January and September 2019. The report estimates the costs exceed $186 million.

The consequences to hospitals can be dire, as patient services become unavailable and medical practices are shut down. Recovery can be slow and expensive: One small health care provider in rural Wyoming was the target of a sophisticated criminal attack in September, and even today, its patient records, prescriptions and appointments are still unavailable. Another ransomware attack in Kentucky locked down medical and insurance records until the clinic agreed to pay $70,000.

About Ransomware: What is it?

Ransomware, also known as cyberviral extortion, is a type of malware that encrypts the victim’s computer, preventing access to all data. Unlike other kinds of cyberattacks, the victim is notified in the form of a demand for money before the data is decrypted and control restored. The attacker typically demands payment in some type of virtual currency, such as Bitcoin, so the perpetratror cannot be traced.

A ransomware attack is usually carried out with a “Trojan Horse” that masquerades as a legitimate file, sent through email as an attachment that the user is tricked into downloading. These attacks began in 2012. During the first six months of 2018, there were well over 181 million ransomware attacks around the world, a 230 percent increase from the same period of 2017.

Hospital Ransomware Attacks

In Alabama, DCH Health System had three of its hospitals shut down because of a ransomware attack. For nearly a week, these facilities could not accept any but the most seriously ill and injured patients until the company was forced to pay an undisclosed amount for the decryption key that allowed them to access data.

Because health care facilities are more likely to give in to attackers’ demands in order to restore operations as soon as they are able, cybersecurity experts say hospital ransomware attacks will continue to be a major issue. Speaking to TechTarget, Shawn Kanady of Trustwave SpiderLabs explained: “Not everyone is paying, so attackers want to hit institutions or companies that are going to hurt the most because they’ll be put in a position where they’ll have to pay, like hospitals or city municipalities.”

Tragically, when vital patient data is inaccessible, the consequences can be fatal. Even when data has been backed up to a remote server, a full restoration can cost more than the ransom – meaning that for the time being, these cyber-predators have little incentive to cease their activities. Hospitals are required to have strong cybersecurity measures in place, but they do not always have the financial resources and staff to fully protect themselves.

Who is Liable for Hospital Ransomware Attacks?

For hospitals that fall victim to ransomware, paying off the cyber extortionists can be just the beginning. Because the law requires health care facilities to protect their data, if patients are harmed as a result of the attack, these hospitals may be held liable in a court of law.

Join a Free Hospital Ransomware Attack Class Action Lawsuit Investigation

If you were a patient at a hospital or healthcare facility affected by a ransomware attack that impacted your medical care, you may qualify to join a hospital ransomware attack class action lawsuit investigation.

Learn More

This article is not legal advice. It is presented
for informational purposes only.