By Marianne Kolbasuk McGee (HealthInfoSec)
A wave of cyberattacks against US hospitals shows no signs of abating as a Florida-based multistate healthcare system and a Maryland hospital curtail patient services.
Tallahassee Memorial HealthCare says it is diverting emergency patients and is only accepting Level 1 trauma cases from its immediate vicinity while it deals with an “IT security incident” that occurred late Thursday night. The hospital did not immediately respond to Information Security Media Group’s request for details including whether the incident involved ransomware.
In a Friday statement, the center, which serves North Florida and South Georgia, said it has taken systems offline as “a precautionary measure.”
Atlantic General Hospital in Berlin, Maryland, also reportedly has been responding to a ransomware incident this week. Hospital officials confirmed to local media site Ocean City Today that Atlantic General is experiencing a ransomware event.
Although some ransomware-as-a-service criminal groups avowedly tell their affiliates not to attack medical clinics, the healthcare sector has proved too alluring a sector for many criminal extortionists to overlook. Hospitals hold highly sensitive data, and the healthcare sector has a reputation for being more willing to pay off attackers than suffer continued outages.
American nonprofit health systems have also recently experienced a surge in distributed denial-of-service attacks initiated by the pro-Kremlin hacking group KillNet, which apparently had no qualms about temporarily incapacitating roughly 20 public-facing hospital websites. Unlike the incidents underway in Florida and Maryland, those attacks don’t appear to have exacted any material effect on hospital operations.
The incident at Tallahassee Memorial HealthCare has led hospital administrators to oblige some patients to reschedule nonemergency appointments as it responds to the incident. “Patients will be contacted directly by their provider and/or care facility if their appointment is affected,” TMH says.
The Florida hospital includes a 772-bed acute care hospital, a surgery and adult ICU center, a psychiatric hospital, multiple specialty care centers, three residency programs and 38 affiliated physician practices.
In Maryland, Atlantic General has closed outpatient imaging services, walk-in lab services and its pharmacy “until further notice,” according to a statement on its website.
Not-for-profit Atlantic General Hospital is part of Atlantic General Health System, which also includes 40 family physicians, internists and specialists with offices in 17 locations throughout the Maryland, Virginia and Delaware region.