Hacked hospital chain says all 250 US facilities affected

https://www.bleepingcomputer.com/news/security/uhs-hospitals-hit-by-reported-country-wide-ryuk-ransomware-attack/

by finphil • 6 years ago

78 31 6 years ago

bleepingcomputer.com

rbanffy4• 6 years ago

I find the name Universal Health Services remarkably amusing for a private healthcare enterprise.

BuildTheRobots• 6 years ago

Name for the business you want rather than the customer base you have.

edit: apologies for the jokey answer but it's a serious point. I don't think it's an ironic name for a private company at all. If I'm selling healthcare services of course I want 100% of people buying them from me, ideally with the only competition being my subsidiaries.

rathertrue• 6 years ago

A friend points out that housing developments are often named after what they destroyed to put it there. "Shady Creek", "Deer Run", "Pleasantview"...

rbanffy4• 6 years ago

Nice burn. Indeed - the existence of private for profit healthcare creates incentives for sabotaging universal healthcare.

jiveturkey• 6 years ago

patriot act

jrott• 6 years ago

They can always hope for the sweetheart public private partnership if we ever get universal health care

gruez3• 6 years ago

How so? "Universal healthcare" just mean everybody has healthcare. It doesn't mean it has to be provided by, or be paid for by the government. Several European countries (eg. Germany, Switzerland, Netherlands) all have universal healthcare that's at least somewhat privately funded.

Judgmentality• 6 years ago

Because universal healthcare is not a thing in the US, and this article is specifically referencing US hospitals.

rbanffy4• 6 years ago

Does everybody really have healthcare?

mightytravels• 6 years ago

Does hacked mean they had their database open to the Internet again?

DudeInBasement• 6 years ago

Probably someone just looking for how much an xray costs. Instead got the whole database.

SkyPuncher• 6 years ago

My understanding is this was a ransomware attack.

danthemanvsqz• 6 years ago

I guess they don't have db snapshots.

choward• 6 years ago

Or they don't want private information to be released. However, paying the ransom doesn't guarantee this.

dc3k• 6 years ago

The term "hospital chain" is so strange to me. Like a restaurant chain, but for health care?

Scoundreller2• 6 years ago

It helps stop insurance companies and patients from playing them off eachother on price.

throwaway13337• 6 years ago

In other words, price fixing but legal.

ZeroCool2u• 6 years ago

More details in the Bleeping Computer article: https://www.bleepingcomputer.com/news/security/uhs-hospitals...

dang• 6 years ago

Ok, we'll change to that from https://apnews.com/article/virus-outbreak-malware-software-1.... Thanks!

gruez3• 6 years ago

What's up with the last few paragraphs of the article? Seems like a very awkwardly planted marketing blurb for Emsisoft.

afrcnc• 6 years ago

because it is

also the linked article doesn't say anything about 250 facilities

think they intended to link this article: https://abcnews.go.com/Health/wireStory/hacked-hospital-chai...

martyvis• 6 years ago

The article says "No patient or employee data appears to have been accessed, copied or otherwise compromised.". And yet the attack seems too have potentially attacked every computer in the health service. If they don't have patient or employee data on them, what do they use their computers for? Playing Tetris?

viraptor• 6 years ago

Disclaimer: I don't know how this specific chain does their security/it.

There are many ways the endpoints can be owned but not the data. One option common in healthcare is that the computers are dumb terminals for sessions on a remote server. Another is that to access the data you have to authenticate with a physical smart card.

As long as it's confirmed that the ransomware only attacked the endpoints and no active data exfil was attempted (or hasn't succeeded), the statement may be completely true.

fallingfrog2• 6 years ago

Starting to look like a pattern, this is several major companies getting ransomed in the last month. Probably organized crime. Ransoming a hospital is especially egregious, so I hope the perpetrators are caught.

ficklepickle• 6 years ago

Oh yeah, definitely that big bad organized crime. Evil people just being evil because they are evil, probably cackling right now, too.

Or maybe it's a moderately-skilled person in an underdeveloped country, who, despite being moderately skilled, has no legitimate opportunities. Maybe the person responsible even has mixed feelings about it. Who knows?

That poor US hospital, I'm sure it is a bastion of fairness and equality for all. I'm sure this wasn't facilitated by their own greed and negligence.

Save your pearl clutching for nextdoor. Here we like to understand the factors that lead to a particular outcome, rather than moralizing hysteria.

fallingfrog2• 6 years ago

Hysteria? Pearl clutching? What are you talking about? Get a grip.

When hospitals can’t access their information, people die. Some crimes are victimless; this isn’t. Actual innocent people are going to be harmed. Good grief. Get your priorities straight and stop trying to start flame wars.

andrewjl• 6 years ago

What sort of regulatory process does software used in a hospital need to undergo? I'm aware of patient privacy requirements like HIPAA, are there others?

Maven911• 6 years ago

There are certification programs for HIPAA such as HITRUST. US centric though, other regions will have local requirements

Hacked hospital chain says all 250 US facilities affected

Related Stories