Somersworth, New Hampshire-based Atlantic Digestive Specialists is one of the latest healthcare organizations to report a ransomware attack that has potentially resulted in the protected health information of patients being accessed.

The ransomware attack was discovered on February 20, 2017 although a subsequent investigation revealed that the ransomware was installed on February 18. The infection took two days to resolve, during which time access to certain computer systems was limited. All traces of the ransomware were removed from its systems by February 22, 2017.

Atlantic Digestive Specialists hired a third-party cybersecurity firm to conduct a thorough investigation of the attack to determine how the infection occurred, the extent of the attack, and which files were potentially accessed by the attackers.

The investigation revealed files containing patients’ names, addresses, telephone numbers, medical record numbers, clinical and diagnostic information, health insurance details, and in some cases, Social Security numbers were encrypted.

The investigation uncovered no evidence to suggest any sensitive data were accessed or stolen by the attackers, and no reports have been received to suggest any patients’ protected health information has been misused. Since the possibility of data theft could not be ruled out with a high degree of certainty, all affected patients have been advised to be vigilant for signs of fraudulent activity. Out of an abundance of caution, patients have been offered credit monitoring services to protect them against identity theft and fraud.

Over the past few weeks, several small healthcare practices have been attacked with ransomware. While in most cases data have been recovered from backups and no ransom has been paid, the attacks have resulted in considerable disruption and sizable breach resolution costs.

Regular backups of data should be performed to ensure no ransom needs to be paid in the event of an attack and small healthcare organizations should consider augmenting their defenses against ransomware.

Since the majority of ransomware attacks occur via email, staff should be advised to exercise caution and not to open any email attachments from unknown senders, never to enable macros on emailed office documents, and to be wary of hyperlinks sent via email..

Information on how HIPAA Rules apply to ransomware attacks is available from the Department of Health and Human Services on this link.

The post PHI Potentially Compromised in Atlantic Digestive Specialists Ransomware Attack appeared first on HIPAA Journal.

A recent Cardiology Center of Acadiana ransomware attack has resulted in the exposure of almost 9,700 patients’ protected health information. The ransomware attack occurred on February 7, 2017 and was discovered the following day.

The attackers targeted a server used by the Lafayette, LA-based cardiology practice and deployed ransomware, which encrypted a range of files containing patients’ names, dates of birth, addresses, billing information, clinical data, medical images and social security numbers.

Cardiology Center of Acadiana has not disclosed exactly how the attack occurred, nor the variant of ransomware used in the attack, although the breach report suggests the attackers utilized open external ports on the server. All external ports have now been closed to prevent future attacks and the cardiology center’s antivirus protections have been upgraded.

Cardiology Center of Acadiana has not received any reports suggesting patients’ PHI has been copied or misused, although all patients impacted by the incident have been advised to exercise caution in case the attackers were able to steal their PHI.

The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 9,681 patients were impacted.

A recent study published in JAMA Internal Medicine indicates larger healthcare organizations face a higher risk of experiencing data breaches, but when it comes to ransomware, healthcare organizations of all sizes are at risk.

So far in 2017, the following healthcare organizations have reported being attacked with ransomware:

Ashland Women’s Health

ABCD Pediatrics

Estill County Chiropractic

Urology Austin

Metropolitan Urology

Cosmetic Surgery Center

Steps to Take to Protect Against Ransomware Attacks

Unfortunately, there is no single cybersecurity solution that can be deployed to prevent ransomware attacks. The best approach is to adopt a layered approach to cybersecurity which should include an advanced firewall along with solutions to block the main attack vectors.

Anti-virus and anti-malware solutions should be implemented and malware definitions kept up to date, a spam filtering solution should be deployed that is capable of analyzing inbound emails and blocking email attachments that pose a threat. Web filter should also be considered to reduce the risk of attacks via exploit kits. Word Macros should also be blocked.

Ransomware will typically run in the app data and local app data folders. Many cybersecurity solutions prevent ransomware from being executed in these folders if downloaded. Ransomware typically requires access to a C2 server to allow data to be encrypted. An intrusion detection system (IDS) can be used to block those communications and prevent file encryption.

In addition to technical solutions, all users should receive security awareness training highlighting the risk of opening email attachments from unknown senders, running macros, or installing unauthorized software.

Steps should also be taken to reduce the impact of a ransomware attack. Regular backups should be performed to ensure data can always be recovered. User privileges should also be restricted as ransomware will gain access to the same resources as the user. Access to mapped network drives should therefore be restricted.

Most ransomware attacks are not targeted. Cybercriminals take advantage of vulnerabilities that have not been addressed to gain access to end points and servers. It is therefore important to ensure security patches are applied promptly and vulnerability scans are regularly performed.

The post Cardiology Center of Acadiana Ransomware Attack Impacts 9,700 Patients appeared first on HIPAA Journal.

Since the start of 2016, cybercriminals have been increasingly turning to ransomware to attack healthcare organizations. Rather than attempting to steal the electronic protected health information of patients, malicious actors are blocking access to ePHI and are issuing ransom demands to restore access.

While large healthcare organizations such as MedStar Health are major targets for cybercriminals, healthcare organizations of all sizes are at risk of experiencing ransomware attacks, even small one-practitioner medical centers.

This week, one such practice has announced a ransomware attack has resulted in patients’ ePHI being encrypted. Ashland Women’s Health (AWH) is a small obstetrics and gynecology practice in Ashland, Kentucky. Earlier this month, AWH submitted a report of a hacking/IT incident to the Department of Health and Human Services’ Office for Civil Rights. The breach report indicates 19,727 patients were impacted.

This week, further information on the security breach has been released. The security breach was caused by a malicious actor who gained access to the computer system used by AWH and installed a ransomware variant called HakunaMatata. HakunaMatata ransomware is a variant of NMoreira ransomware.

While electronic protected health information was encrypted by the ransomware, a ransom payment was not made to regain access to data. AWH was able to recover all encrypted EHR data from backups.

The ransomware attack was reported to the FBI and law enforcement and an investigation is being conducted. AWH has now successfully restored patient data and has brought its systems back online. AWH experienced downtime of around two days following the attack while the infection was removed and data were restored. During that time, medical services continued to be provided, with staff resorting to pen and paper to record health information and schedule appointments.

In accordance with HIPAA Rules, breach notification letters will shortly be sent to all affected patients.

The post Ashland Women’s Health Reports Ransomware Attack appeared first on HIPAA Journal.

A computer virus sent via email to staff at Erie County Medical Center in Buffalo, New York – the main teaching hospital used by the University of Buffalo – has forced the hospital to shut down its entire computer system, parts of which remain out of action three days later.

The incident occurred in the early hours of Sunday morning. IT staff reacted promptly and shut down email and took the entire computer system offline as a precaution to prevent the spread of the virus. The IT team, assisted by external security experts, is working to systematically restore its systems. That process is expected to take several days, although most computer systems at the hospital have now been brought back online. The hospital’s email system is still not operational and its website is still inaccessible. The hospital has a backup of all data, including patients’ health information. A full recovery is therefore expected.

Staff at the hospital have been forced to temporarily work with pen and paper while the IT security incident is resolved. Communication between care teams has continued using ECMC’s proprietary text messaging system. A spokesperson for the hospital says operations are continuing as normal and patient services have not been affected.

Peter K. Cutler, ECMC’s Vice President of Communications and External Affairs, said “We have concerns about the motivation that led to this virus, and we are working with the appropriate agencies to determine the validity of whatever information we’ve received as a result of this virus coming into our system.”

The hospital is “confident that no patient information has been compromised,” however, at this stage, that cannot be entirely ruled out. The investigation into the attack is continuing and once systems have been restored, ECMC will be conducting a complete post-infection analysis to ensure that no further malware or viruses remain on its system. Law enforcement agencies, including the FBI, have been notified of the cyberattack.

The nature of the virus has not been disclosed, although the incident bears the hallmarks of a ransomware infection. Targeted ransomware attacks on hospitals are occurring, with at least one malicious actor using Philadelphia ransomware to attack hospitals and encrypt data. Those attacks started in the third week of March.

A decryptor has been released to unlock files encrypted by Philadelphia ransomware, although many ransomware variants have yet to be cracked. Decrypting data is only possible if a ransom is paid, something the FBI and other law enforcement agencies strongly advise against.

In order to ensure a complete recovery from a ransomware attack is possible, healthcare organizations must regularly backup their data and test those backups to make sure data can be recovered in the event of a disaster.

The post Virus Infection at Erie County Medical Center Forces Computer System Shutdown appeared first on HIPAA Journal.