The Center Hospitalier Sud Francilien (CHSF), a 1000-bed hospital located in Corbeil-Essonnes 28km SE from the center of Paris, has been virtually paralyzed by a cyberattack. Nearly all IT systems appear to have been taken off-line by a ransomware attack discovered on August 21, which has resulted in the medical center referring patients to other establishments and postponing appointments for surgeries. Non-critical services have had to be directed elsewhere, and staff are now working with limited resources.
"Each day we need to rewrite patients' medications, all the prescriptions, the discharge prescriptions," said Valerie Caudwell, the president of the medical commission of the CHSF hospital. "For the nurses, instead of putting in all the patients' data on the computer, they now need to file it manually from scratch."
Medical imaging has been particularly impacted resulting in all PACS and other imaging services currently being off-line. Many medical devices were highly susceptible to the cyber-attack and may have been at the core of the ransomware attack. Like most hospitals, patching of medical devices against known security vulnerabilities appears to have been lax, making them an easy target for hackers to establish a foothold on the medical network.
“Without security enclaving or segmentation of vulnerable medical devices, these systems wouldn't have stood a chance,” claims Richard Staynings, Chief Security Strategist at healthcare security company Cylera. “It's impractical or impossible to patch devices where manufacturers have not released a patch, so you really need to isolate high-risk systems as a form of compensating security control,” he added.
CHSF serves an area of 600,000 inhabitants, so any disruption in its operations can endanger the health, and even lives, of people in a medical emergency. Unlike a similar ransomware attack in 2020 against Düsseldorf University Hospital, where a 78 year old woman suffering from an aortic aneurysm died after being redirected to a different hospital 32km away, no deaths have been reported at CHSF.
The hospital has refused to pay a ransom demand of ten million dollars and is rebuilding its IT systems from scratch while restoring patient data from backup, a process which it expects to take many days.
Police specializing in cybercrime are investigating. Cyber-attacks targeting hospitals in France have been increasing recently, with 380 last year, a 70 percent rise from 2020.
"An investigation for intrusion into the computer system and for attempted extortion in an organized gang has been opened to the cybercrime section of the Paris prosecutor's office," a police source told Le Monde, also specifying that "the investigations were entrusted to the gendarmes of the Center fight against digital crime (C3N)".
While police and cybersecurity experts continue to investigate this attack, “the Tactics, Techniques, and Procedures (TTPs) indicate a LockBit 3.0 infection,” according to Jordan Rogers, head of cyber threat intelligence at Cylera. However, if LockBit 3.0 is responsible for the attack, it will violate the Ransomware as a Service (RaaS) program's rules, which prohibit affiliates from encrypting systems of healthcare providers.
At this time, the attribution to the particular threat group hasn't been confirmed yet, and LockBit 3.0's extortion site contains no entry for CHSF yet, so their involvement remains a hypothesis. Gang affiliates using this RaaS are known to operate primarily in Russia and Belarus.
Cylera solves the growing problem of medical device and other healthcare IoT risk. It does so seamlessly and automatically by integrating with existing security and IT tools by employing advanced AI techniques and its proprietary Digital Twin™ technology. Contact us if you would like to learn more.
