A New Jersey hospital said that it was forced to cancel some surgeries and other medical procedures after falling victim to a ransomware attack.
Hackensack Meridian Health, a non-profit health care center based in Edison, New Jersey, revealed to the Wall Street Journal (WSJ) that the attack began on December 2. As a result of both that security incident and bad weather, the hospital canceled fewer than 100 scheduled surgeries and medical procedures. The health care center did not clarify how the ransomware initially infected its computer systems. It also did not quantify the ransom amount that it ultimately paid, explaining only how its staff feels "...it’s [their] obligation to protect [their] communities’ access to health care." It did note, however, that the security incident didn't harm any of its patients and didn't prevent its emergency rooms from seeing patients. Upon discovering the ransomware infection, Hackensack Meridian Health launched an investigation to determine what had happened. This effort revealed that the security incident had not exposed the information of either its patients or its staff members. Additionally, the hospital notified the FBI and hired a digital forensics firm to conduct its own investigation. Hackensack Meridian Health said it's now in the process of working with New Jersey’s Health Department to fully restore its systems. The health care center said in a statement that it's these types of partnerships that will prove integral to the fight against ransomware going forward. As quoted by the WSJ:
As the frequency of these crimes grow, it is imperative that we work collectively—non-profit and for-profit organizations, large companies and small—with regulators and lawmakers to safeguard our vital enterprises and institutions.
It's important that organizations strengthen their defenses against a security incident such as the one described above by taking steps to prevent a crypto-ransomware infection in the first place. This resource is a good place to start.
