(Another) Hospital Falls Victim to Ransomware

A UK hospital is back online several days after a virus crippled its network.

Following an infection on Sunday, the National Health Service's Northern Lincolnshire and Goole (NLG) Foundation Trust temporarily shuttered a majority of its systems to "isolate and destroy" the bug. As of Thursday, things are back up and running, and the facility is accepting patients.

"We have stood down from a major incident this morning as our key clinical systems are now operational," Karen Dunderdale, deputy chief executive of the NHS NGL Foundation Trust, said in a statement.

"There continues to be a small number of linkages which enable our systems to talk to each [other] which remain inconsistent," she added. "We are continuing to work with our third-party suppliers to restore these as soon as possible."

The NHS has not revealed additional details about the virus, but security researcher Brian Krebs suggests an infection of ransomware—a malware strain used recently to target hospitals and healthcare facilities.

Earlier this year, Hollywood Presbyterian Hospital in California paid attackers 40 bitcoins (approximately $17,000 at the time) to free its systems from ransomware. A month later, Methodist Hospital in Kentucky became the target of an attack; hackers demanded four bitcoins ($2,927 at today's exchange rate) for a key to unlock the encrypted files.

And these aren't just one-off cases: Intel Security recently reported more than 20 ransomware-related data loss incidents per day in the healthcare sector. In the first quarter of this year, hospital attacks generated about $100,000 in ransom payments.

Recommended by Our Editors

How to Protect and Recover Your Business from Ransomware

Ironically, the NLG Foundation Trust was hit two days after UK Chancellor Philip Hammond unveiled a national cybersecurity strategy, emphasizing the responsibility of company executives to ensure their organizations are secure.

"I would like to take this opportunity to apologize to everyone who has had their appointment cancelled this week," Dunderdale said in a statement, promising to reschedule folks "as soon as possible."

In many cases, these infections are due to human error, from people plugging in unknown USB drives that infect systems to phishing emails that dupe employees.