Doctors’ Management Services Hit by Ransomware Attack

According to a report by SC Media Magazine, cyber-criminals made an attempt to extort money from Doctors’ Management Services (DMS)  on  Dec. 24, 2018.  Fortunately, the medical ransomware attack was unsuccessful; DMS was able to reconstruct the threatened database from backups. Nonetheless, the incident serves as a stark reminder of the vulnerability of health care providers and ancillary services that keep sensitive and private patient information on computer systems, and the ongoing danger of cyber predators.

How it Happened

According to Doctors’ Management Services CEO Timothy DiBona, the attack was noticed on Christmas Eve when all database files became encrypted with what turned out to be a ransomware program, known as “GandCrab.”

A subsequent investigation reportedly revealed that the ransomware attack actually began over a year and a half earlier, on April 1, 2017. However, it had been impossible to detect malicious activity until the files were being encrypted.  The attack came by way of  Remote Desktop Protocol (RDP), according to reports, a proprietary system developed by Microsoft that enables a remote user to access computers on a network.

Patient data that was at risk included names, addresses, dates of birth, Social Security numbers, driver’s license numbers, insurance, and Medicare/Medicaid information and account numbers as well as health information and diagnostic and test results. Doctors’ Management Services notified all its clients of the attack; DiBona is confident that no sensitive patient records had been compromised.

About GandCrab

This particular form of ransomware reportedly targets Windows systems used by businesses. Once it infects a system, GandCrab encrypts files, adding a “.CDCB” extension to each one, rendering them useless.  It then generates a ransom demand in the form of a text file, which typically includes the demands, instructions, and information on the extortionist’s cryptocurrency wallet.

Oddly, in May of last year, the cybercriminals behind GandCrad reportedly announced that they would be “retiring” with their ill-gotten gains, which they claim amounted to over $2 billion. It has also been noted that GandCrab does not appear to infect computers in Russia or other former Soviet states, which may indicate that the extortionists had been operating out of that part of the world.

Doctors’ Management Services Foresight Avoided Catastrophe

DMS, a medical billing service, had the foresight to back up all of its files in case of a ransomware attack or other potential disaster. However, this has not been the case with other health care service providers, which have borne the brunt of ransomware attacks over the past few years.

Nearly three dozen hospitals, clinics, university health centers, and medical billing companies have been the victim of ransomware. This is more than an inconvenience, and the dangers go beyond monetary losses; inability to access patient medical records can put lives at risk. Last November, the media reported that hospitals hit by ransomware attacks have seen an increase in deaths from heart attacks, as EKG machines rely on computer systems. Hospitals affected by ransomware must also turn patients away and delay needed procedures.

The latest system, Windows 10, offers robust protection against malware; unfortunately, too many hospitals are still running older versions.

Some hospitals have had to close down completely due to “ransomware” attacks on hospital computer systems. The attacks reportedly caused hospitals to be locked out of their computer systems until they pay hackers a hefty sum in Bitcoin.

Not only are healthcare providers rendered unable to properly care for their charges, but patients are also often faced with inconveniences and hassle due to the attacks—appointments can be canceled without notice, important medical records can be deleted, and other problems can occur.

These issues can result in time lost, patients not getting the medical care they need as well as other legal injuries.

Many hospitals may be affected by these ransomware attacks, but the following locations have had confirmed attacks against them:

• DCH Regional Medical Center (Alabama)
• Northport Medical Center (Alabama)
• Fayette Medical Center (Alabama)
• Park DuValle Community Health Center (Kentucky)
• Campbell County Health (Wyoming)

Join a Free Hospital Ransomware Attack Class Action Lawsuit Investigation

If you were a patient at a hospital or healthcare facility affected by a ransomware attack that impacted your medical care, you may qualify to join a hospital ransomware attack class action lawsuit investigation.

Learn More

This article is not legal advice. It is presented
for informational purposes only.