Ransomware Attack Diverts Patients from Some Hospitals

A ransomware attack has forced a health care chain to divert patients from some of its emergency rooms and pause elective procedures.

A ransomware attack has forced a healthcare chain to divert patients from at least some of its emergency rooms to other hospitals. The company, Ardent Health Services, said the attack occurred on Nov. 23 and that it took its network offline to prevent the spread of the malware. The attack has also caused the company to pause certain elective procedures.

Hospitals Continue to Provide Medical Screenings and Stabilizing Care

All of Ardent's hospitals are continuing to provide medical screenings and stabilizing care to patients arriving at emergency rooms. However, the company is asking local ambulance services to transport patients in need of emergency care to other area hospitals. This will ensure that critically ill patients have immediate access to the most appropriate level of care.

No Immediate Claim of Responsibility

There has been no immediate claim of responsibility for the attack. Ransomware criminals do not usually admit to an attack unless the victim refuses to pay. However, a recent global study by the cybersecurity firm Sophos found that nearly two-thirds of healthcare organizations were hit by ransomware attacks in the year ending in March. This is double the rate from two years earlier but a slight dip from 2022.

Increasingly, Ransomware Gangs Steal Data Before Activating Data-Scrambling Malware

Ransomware gangs are increasingly stealing data before activating data-scrambling malware that paralyzes networks. The threat of making stolen data public is used to extort payments. That data can also be sold online. Sophos found data theft occurred in one in three ransomware attacks on healthcare organizations.

Hospitals Need Better Protection

Analyst Brett Callow at the cybersecurity firm Emsisoft said 25 US healthcare systems with 290 hospitals were hit last year while this year the number is 36 with 128 hospitals. "Of course, not all hospitals within the systems may have been impacted and not all may have been impacted equally," he said. "Also, improved resilience may have improved recovery times." "We're not in a significantly better position than in previous years, and it may actually be worse," he said. "We desperately need to find ways to better protect our hospitals. These incidents put patients' lives at risk — especially when ambulances need to be diverted — and the fact that nobody appears to have yet died is partly due to luck, and that luck will eventually run out," Callow added.

Ransomware Syndicates Based in Former Soviet States

Most ransomware syndicates are run by Russian speakers based in former Soviet states, out of reach of US law enforcement. However, some "affiliates" who do the grunt work of infecting targets and negotiating ransoms live in the West, using the syndicates software infrastructure and tools. The Kremlin tolerates the global ransomware scourge, in part, because of the chaos and economic damage to the West — and as long its interests remain unaffected, US national security officials say.

The ransomware attack on Ardent Health Services is a reminder of the growing threat of cyberattacks on healthcare organizations. These attacks can have a significant impact on patient care and safety. It is important for healthcare organizations to take steps to protect themselves from these attacks, such as investing in cybersecurity measures and training employees on how to identify and respond to phishing attacks.