Federal agents are executing warrants at Twin Cities daycare providers

MPR News helps you turn down the noise and build shared understanding. Turn up your support for this public resource and keep trusted journalism accessible to all. 

Turn Up Your Support

Some U.S. hospitals have been hit by coordinated ransomware attacks designed to infect systems for financial gain, federal agencies and a private-sector cybersecurity company warned on Wednesday.

 by the Cybersecurity and Infrastructure Security Agency, the Department of Health and Human Services and the FBI says there is "credible information of an increased and imminent cybercrime threat" to U.S. hospitals and health care providers.

They are urging institutions to take necessary precautions to protect their networks.

The agencies said hackers are using Ryuk ransomware — malicious software used to encrypt data and keep it locked up — and the Trickbot network of infected computers to steal data, disrupt health care services and extort money from health care facilities. Such data hijacking often cripples online systems, forcing many to pay up to millions of dollars to restore their services.

The agencies warned health care providers to step up protections of their networks, including regularly updating software, backing up data and monitoring who is accessing their systems.

Beyond health care facilities, the FBI says ransomware attacks have been 

 for several years against hospitals, school districts, state and local governments and even law enforcement.

Officials do not recommend paying ransoms, as it does not guarantee data will be recovered and could "embolden" hackers to carry out further attacks.

that an unnamed Trump administration official said several hospitals have been targeted in the attacks over the past two days. The official said the incidents may be connected and that the federal government is investigating the attacks.

Experts at the cybersecurity firm FireEye's Mandiant division said the latest spate of attacks were carried out by cyberattackers in Eastern Europe seeking financial gain.

"We are experiencing the most significant cybersecurity threat we've ever seen in the United States," said Charles Carmakal, Mandiant's chief technology officer, describing the group as "one of most brazen, heartless and disruptive threat actors I've observed over my career."

NPR's Steve Inskeep that what makes these attacks notable is their target: hospitals.

 "Most threat actors aren't willing to deploy ransomware and cause destruction to hospitals right now during the pandemic because they're worried about impacting lives," he said. But in this case, the attacker is deliberately targeting hospitals "and has no real fear of potential human impact, and is just looking to make money."

the attacks typically start as emails masquerading as corporate communications containing Google Docs and PDFs with malicious links.

And such attacks could have life and death consequences. 

As hospital administrators find out their systems are under attack, they often take those systems offline, Carmakal said. They then have to revert to paper-based systems to treat patients — and sometimes end up diverting patients to other hospitals, which could be minutes or hours away.

"No matter what, you're going to deal with situations where the ability for the health care practitioners to give care to patients — it's going to get delayed, which could certainly impact people's lives." 

Crime, Law and Justice

Health

Politics and Government News

Shannon Bond

Author

Vanessa Romo

Laurel Wamsley

An alert warns hospitals and health care providers that there is "credible information of an increased and imminent cybercrime threat."

U.S. hospitals targeted in rising wave of ransomware attacks, federal agencies say

Go Deeper.

Like this?

News you can use in your inbox