Hollywood Hospital's Ransom Payment Sparks Concern Over Attack Escalations
By Christine Kern, contributing writer
The move has unleashed a maelstrom of controversy after hospital paid to get its records back.
Ransomware is one of the fastest growing forms of cyberattack and the decision of one of its latest victims to pay to unlock their computer networks has sparked a maelstrom of controversy in the healthcare and cybersecurity circles.
Health IT Outcomes reported Hollywood Presbyterian Medical Center in California was struck by the ransomware on February 5 and was locked out of their computer infrastructure for over a week. The hospital was forced to rely on paper records, faxing, and other “archaic” means of patient care, diverting some emergency patients to other facilities.
According to the hospital, the attack was not malicious and instead, random, leading them to give into ransom demands and pay the $17,000 to return to business. In a statement, CEO Allen Stefanek said, “The malware locks systems by encrypting files and demanding ransom to obtain the decryption key. The quickest and most efficient way to restore our systems and administrative functions was to pay the ransom and obtain the decryption key. In the best interest of restoring normal operations, we did this.”
But that decision has unleashed a firestorm of concern that hackers are escalating their ransomware threats. According to computer security experts cited by the L.A. Times, hospitals are particularly vulnerable targets for ransomware because some medical equipment relies on older operating systems that cannot be easily protected with security measures. Hospitals also have been less proactive in terms of combatting cyber threats, and remain “about 10 to 15 years behind the banking industry” in terms of security, explained Lysa Myers, a researcher with computer security firm ESET.
“Ransomware has been around for several years, but there’s been a definite uptick lately in its use by cyber criminals,’’the FBI wrote in a blog post. The agency said that it is “targeting these offenders and their scams.’’
A November report from Intel Corp.’s McAfee Labs predicted the number of ransomware attacks is will grow in 2016 because of increased sophistication in the software used to do it. The company estimates that on average, 3 percent of users with infected machines pay a ransom.
The highly publicized attack on Hollywood Presbyterian has prompted many legislators and security experts to push for renewed legislation and harder punishments for hackers.California Senator Bob Hertzberg (D) is fighting back with proposed legislation to designate this type of hack as an extortion crime punishable by up to four years in prison, The Los Angeles Times reports. Hertzberg released a statement regarding his legislation, “We must be clear that we will not tolerate this kind of conduct, and that using modern tactics to engage in age-old thuggery of ransom and extortion do not change the seriousness of the crime.”
The proposed bill, SB 1137, outlaws the practice of infecting any computer, system or network with ransomware and states that a person engaged in the activity could be convicted of a felony and be given a sentence of up to four years in prison.