Healthcare Ransomware Attacks Destroy Patient Data at Brooklyn Hospital Center

A Brooklyn, N.Y. hospital has acknowledged the loss of all patient data files due to a ransomware attack over the summer, according to website bleepingcomputer.com. The admission was made after investigators spent several months attempting to recover the data without paying the unidentified extortionists’ demands.

In a Sept. 4 statement, Brooklyn Hospital Center confirmed that “due to the malware, and despite exhaustive efforts by the Hospital to recover the data, certain patient data was unrecoverable.”

It also appears that the hospital did not have a backup system in place. It is not known how many patient records, which include medical images, have been lost.

What Are Healthcare Ransomware Attacks?

Ransomware is a relatively new form of malware, used by extortionists to lock down a victim’s computer, making all files inaccessible until ransom is paid. Once the extortionists’ demands for payment (usually in Bitcoin or some other cryptocurrency) are met, they provide an encryption key that allows the victim to once again access their data.

Although virtually anyone can be targeted by a ransomware attack, these extortionists have been targeting hospitals and other health care facilities in recent years. According to a 2016 report published in Wired, healthcare ransomware attacks have become a prime target for a number of reasons.

For example, access to patient data can literally mean the difference between life and death, meaning that hospitals are far more likely to accede to extortionists’ demands. Another is that hospital employees are typically not trained in cybersecurity issues and how to avoid falling victim to ransomware.

Are Hospitals Legally Liable for Data Loss?

They may be. Medical records are of such importance that every health care facility should have an extensive backup system in the event of software corruption or hardware failure. While defending against healthcare ransomware attacks attacks is not the same as preparing for computer crashes, it is still a hazard that has the potential to cause the same havoc.

In many cases, hospitals that have fallen victim to healthcare ransomware attacks find it less expensive to simply pay the ransom than to risk litigation – although law enforcement agencies do not recommend this since it encourages further attacks and paying the ransom is no guarantee that another attack will not be attempted.

Avoiding Healthcare Ransomware Attacks

In the vast majority of cases, these attacks are carried out using a “Trojan Horse” disguised to appear as a legitimate file or email attachment. The user is deceived into downloading and opening it. The best protection would seem to be prevention: do not open emails or download any attachments that are from unfamiliar or suspicious sources.

In 2017 however, there was an attack by a ransomware “cryptoworm” that targeted computers around the world running older versions of the Windows operating system. Known as WannaCry, this malware had a “transport” mechanism that enabled it to replicate and spread itself without user interaction. This attack infected more than 300,000 computers before it was stopped.

According to Gizmodo, that crisis might have been nipped in the bud had users installed a security patch that Microsoft had made available several weeks earlier.

Join a Free Hospital Ransomware Attack Class Action Lawsuit Investigation

If you were a patient at a hospital or healthcare facility affected by a ransomware attack that impacted your medical care, you may qualify to join a hospital ransomware attack class action lawsuit investigation.

Learn More

This article is not legal advice. It is presented
for informational purposes only.