Following is a story of a data breach. It also involves ransomware and a healthcare facility. However, the information doesn’t only apply to one particular industry. In fact, there is a very valuable and important lesson to be learned from this incident. So, keep reading for some important facts and the information that can help you avoid becoming a victim of ransomware and avoid having to pay to get your own data decrypted.
A Minnesota based psychiatry and psychology practice was the victim. TripleM ransomware was found on the network on March 31. The investigators believe someone was in their system on March 30. The information that was accessible to the attackers was said to have been not “human-readable” and there is no evidence that patient information was indeed seen or extracted offsite. However, potentially whoever did this saw names, birthdates, insurance information, treatment records, and social security numbers.
What is notable about this incident is that the attackers disabled the system restore functionality. In addition, and this is important… they reformatted the network storage devices on which the backups were kept.
So, how did this happen, you ask? After all, good cybersecurity practice says to keep the backups separate from the network so that they cannot be accessed. So if those were stored properly, how could the hackers get to them? Well, indeed they weren’t separate.
Yes, it’s great that Associates in Psychiatry and Psychology did backups. Credit where credit is due. It’s definitely the right thing to do. However, that little extra step of keeping those backups offline or segmented was what they missed. As a result, they were forced to pay the attackers in Bitcoin to get decryption keys and get their data back online.
It’s unknown how the attackers got in. However, most of the time it’s one of two ways: 1) Exploiting a vulnerability, or 2) Someone falling for a phishing attack.
It’s not recommended that any payment be made to retrieve keys to restore your data. Preventing it in the first place is the best advice we can give and to keep those backups current and separated from the main network is a significant tip not to be dismissed.
Always keep systems updated with the latest security patches and updates. Having current anti-virus software and other perimeter security tools in place are also advised. In addition, be sure to keep your employees, contractors, and consultants up-to-date with the latest phishing threats and provide information on how to identify it. In addition, because sometimes mistakes are made, make sure everyone knows what to do if they think they may have fallen for phishing.
The practice reported to the Department of Health and Human Services that about 6,546 patients were potentially impacted.
You see, it doesn’t matter what industry you are working in or who your clients are. It only matters that any organization, of any size can be a victim of ransomware.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
