Ransomware attacks against healthcare facilities are becoming more frequent and severe as the pandemic and workforce shortages stress hospital capabilities. That makes cyberattacks pose potential life-threatening consequences, experts say.
On Aug. 4, Indianapolis-based Eskenazi Health experienced a ransomware attack, halting access to electronic medical records and requiring ambulances to bypass the city鈥檚 safety net hospital.
Now, nearly two weeks later, the hospital is still recovering. But electronic medical records are currently back online, according to a hospital spokesperson.
The hospital has not released information on the demands of the hackers or how the virtual attack took place.
An Eskenazi nurse who spoke to Side Effects on the condition of anonymity said she and many of the newer nurses were in unfamiliar territory following the attack without access to electronic medical records. This meant a loss of one of the checks and balances that normally go into patient care.
鈥淚'm already an anxious kind of type-A in control person,鈥� she said. 鈥淎nd for us to have just lost all ability to kind of keep all my ducks in a row, had me on edge.鈥�
The nurse said more than anything the attack slowed patient care -- like when a patient couldn鈥檛 recall the dosages of her medication from home, and it couldn鈥檛 be easily checked on the computer.
She said that it鈥檚 given her a new appreciation for the required cybersecurity training.
鈥淲hen I'm doing the education, I roll my eyes and think it's silly and overkill,鈥� she said. 鈥淏ut now that we've experienced it, of course, I get it, and will definitely take it more seriously.鈥�
The 鈥榠t won鈥檛 happen to me鈥� attitude is dangerous, said John Riggi, senior advisor for cybersecurity and risk for the American Hospital Association. Healthcare facilities have become a specific target for foreign criminals. The FBI reported a 37% annual increase in reported ransomware cases from 2018 to 2019.
鈥淭hey're being attacked, because [hackers] know that public health and safety depends upon the availability of the hospital,鈥� Riggi said. 鈥淎nd therefore creates an exigency and urgency for the hospitals to remediate the situation.鈥�
In Indiana, these attacks can lead to significant delays in care, such as transfers of critically ill patients, for already overburdened or rural hospitals. In 2020, Germany reported the first-known death from a hospital cyber attack when a critically injured patient had to be taken to a hospital in another town.
鈥淲hat I constantly say to my colleagues is that when a ransomware attack on a hospital crosses the line from an economic crime to a threat-to-life crime,鈥� Riggi said.
While the specifics of cyberattacks can vary, a majority of attacks begin via a phishing email. This is when an employee clicks a link in their email that sends them to a site where they inadvertently give away log-in or password information. These emails can be sophisticated and highly targeted. Often they appear as if they鈥檙e coming from trusted sources like vendors, contractors or colleagues.
Even as hospitals prepare for these kinds of attacks, cybercriminals have responded. If hospitals can restore their records without paying a ransom, hackers may use extorted patient records as leverage, threatening to sell the confidential information on the dark web.
The FBI recommends hospitals don鈥檛 pay ransom to cybercriminals to avoid incentivizing future attacks. But, it鈥檚 a challenging choice that could require months of remediation and costs that outpace the original ransom.
However, Riggi says, an estimated 30% of healthcare institutions pay the ransom.
鈥淚t's almost an impossible decision, pay the ransom and restore operations, maybe there's still no guarantee... it'll work,鈥� Riggi said. 鈥淥r not pay, and you might not have the ability to restore quickly or independently.鈥�
It鈥檚 a decision Hancock Regional Hospital CEO Steve Long experienced firsthand.
In 2018, Long was at home, ready for bed when he received a call from another administrator who said something was wrong with the hospital鈥檚 computer network. They soon discovered hackers had encrypted the hospital鈥檚 files and requested a ransom, launching a four-day race to recover control of their network.
鈥淪ay if somebody walked into your house, found the place where you keep your valuables and put a padlock on the door, that you can't get through without their key,鈥� Long said. 鈥淪o it never left your house, and you don't have access to it.鈥�
Ultimately, Long and his team decided to pay the $55,000 ransom to quickly bring the hospital to full functionality.
鈥淲e were like everybody else, that it was always going to happen to somebody else, not to us,鈥� Long said.
Since the attack, the health system hired around-the-clock staff monitoring hospital systems, artificial intelligence scanning the network for anomalies and new hardware for computers.
鈥淲e spend about three times more than we did before,鈥� Long said. 鈥淚t is very well worth it.鈥�
Leaders in Washington, D.C. are taking notice of the growing cyber attacks on hospitals, local governments and other institutions. The Biden administration recently elevated ransomware attacks to a similar priority as terrorist attacks.
Eskenazi Health officials have not said when they expect to return to full operations. The hospital remains open and has been off of diversion since Aug. 11th.
Copyright 2021 Side Effects Public Media. To see more, visit .
