MedStar And Other Hospitals Hit With ‘Ransomware’ Virus – $18.5K To Decrypt Windows Web App Server Injected With Samsam Malware?

MedStar hospital has been a victim of a “ransomware” attack. However, it seems it is just one of the many victims of “Samsam” malware that has been specifically targeting healthcare establishments and encrypting patient data to extort money.

The ransomware attack that locked out MedStar hospital staff from their patient database may just be the tip of the iceberg . It appears Baltimore’s Union Memorial Hospital was the central point of the attack that spread to other establishments under the MedStar umbrella. The Inquisitr previously reported that MedStar hospital had suffered from a suspected ransomware attack, which was being investigated by the Federal Bureau of Investigation (FBI).

MedStar shut down EHR for thousands of doctors after likely ransomware attack https://t.co/YLIb0jcMZf pic.twitter.com/AdTBiz7Gcy

— Medscape (@Medscape) March 31, 2016

As it turns out, data at Union Memorial and other MedStar hospitals in Maryland have been encrypted by a ransomware virus. Moreover, the attackers appear to have put forth their demands: 45 bitcoins. At today’s exchange rate, the attackers are demanding $18,500. In lieu of the crypto-currency, operators of the malware will send across decryption keys that will allow the hospitals to regain access to their patient data and resume entering and retrieving information from the digital database. For 45 bitcoins, the keys to unlock the entire network will be offered through a “bulk” deal. It is not immediately clear if MedStar will fork over the cash as another hospital had recently did.

It is now confirmed, The MedStar Hospital Chain was hit with ransomware and has received a digital ransom note. A Ba… https://t.co/a02tEZ8oAU

— Red Team USA . . . (@RedTeamUSA) April 1, 2016

How was the hospital system crippled? FBI was well aware that hackers were persistently attempting to target healthcare establishments. In fact, according to Reuters, FBI had issued a confidential urgent “Flash” message to the industry about the threat of Samsam on March 25. The law agency had even shared signature data, which pinpointed Samsam activity to help the organizations monitor their systems and identify a potential attack before the malware encrypted the files. However, given the vulnerability of the systems, the number of victims could easily increase. FBI fears entire networks of hospitals could be crippled with the ransomware attack before the establishments become aware of what’s happening.

The attack on MedStar Health was #ransomware, and elements mirror ransomware warned about by FBI https://t.co/FdVbDj9Xdc by @Dan_Bowman

— FierceHealthIT (@FierceHealthIT) March 31, 2016

The attack is quite complex and requires penetrating multiple levels of security and stealing login credentials. Vulnerable and weakly protected web app servers are the primary point of entry, after which multiple exploits work simultaneously to detect even more weaknesses. Multiple instances of malware, masquerading as security tools, fool the system into allowing malicious code to be run. Incidentally, investigators are confident the attacks were manually coordinated and left to automated hacking tools, usually deployed by such cyber criminals.

Your biggest #infosec threat is your insider, and it rings true in wake of MedStar ransomware attack: https://t.co/VhHuCHLw4k #RansomAware

— Carbonite (@Carbonite) March 31, 2016

Hospitals are known to crumble under pressure since patient records are highly dynamic and real-time updates help schedule medical procedures and monitor the patient. When medical professionals are locked out of such databases, they have to rely on handwritten records, which can slow down the entire process to a snail’s pace. Hospitals that have been the victim of a ransomware attack have been known to reschedule non-emergency procedures while dealing with patients on a case-by-case basis. If the hospitals don’t pay, their staff continues to struggle, resulting in losses as well as putting patients’ lives at risk.

WJZ obtains email from FBI source confirming ransomware is the cause of MedStar cyber attack @cbsbaltimore pic.twitter.com/d1JNYETjRj

— Mike Hellgren (@HellgrenWJZ) March 30, 2016

The issue of coordinated attacks using ransomware virus is so high that the U.S., as well as Canada, jointly released a rare cyber alert, reported Yahoo News. The governments have strongly discouraged the victims to give into the demands of hackers in order to regain access to the data and control of the systems, read the alert.

“Paying the ransom does not guarantee the encrypted files will be released. It only guarantees that the malicious actors receive the victim’s money, and in some cases, their banking information.”

Do you think MedStar hospital yield to the hackers and pay them to regain control of their systems crippled by the ransomware attack?