The IT systems of three US hospitals have been infected with ransomware, which encrypts vital files and demands money to unlock them.
The systems, at Kentucky Methodist Hospital and Chino Valley Medical Center and Desert Valley Hospital, California, are now running normally again.
None of the hospitals is believed to have paid the ransom.
And the cases are now being investigated by the FBI.
The Kentucky Methodist Hospital had to shut down all of its desktop computers and activate a back-up system.
A message on its homepage said: "Methodist Hospital is currently working in an internal state of emergency due to a computer virus that has limited our use of electronic web-based services.
"We are currently working to resolve this issue, until then we will have limited access to web-based services and electronic communications."
It later said no patient data or care had been affected.
Fred Ortega, a spokesman for Prime Healthcare Services, which owns Chino Valley Medical Center and Desert Valley Hospital, said: "It did cause significant disruptions of our IT systems.
"However, most of the systems and the critical infrastructure has been brought back online."
The attack comes weeks after it was revealed Hollywood Presbyterian Medical Centre in Los Angeles had been attacked by ransomware.
In that case, it paid $17,00 to get access to files back.
http://www.bbc.co.uk/news/technology-35880610
>>33067
https://www.foolishit.com/cryptoprevent-malware-prevention/
Literally, there is a fucking free piece of software to prevent this.
Hospitals, especially smaller ones, have the biggest fucking IT issues in America, I fucking swear.
/g/entleman here. I do Contract IT. Have a hospital group as a client. They will try to wriggle and writhe their way out of every IT cost they can. Fighting me over 15 minutes spent over an evening to investigate why they had an ssh connection attempt come from Taiwan randomly (was automatically rejected, but still). America's Healthcare system isn't fucked because it's not single-payer, it's fucked because of doctors/lawyers who think they "deserve" 6-7 figures a year after spending XX amount of years in school and will do everything in their power to make as much money as they possibly can. Even if it means ruining/killing people's lives.
>>33067
understated story
>no backups
>>33379
The stories I've heard from people working medical IT scare me.
Is HIPPA as much a joke IT-wise there as it is elsewhere? I worked software dev for a therapy company - they had passwords stored in plaintext.
>>33379
>Literally, there is a fucking free piece of software to prevent this.
Yes, it's called Firefox with Ad Block and NoScript. They got this from a drive-by infection due to using Internet Exploder. It likely came in an infected email or website. If email, there are 2 ways this happens - dynamically updated web UI that automatically deals with attachments (don't let it do this) or Outlook and it wasn't set to not automatically open emails. Infected Word documents or out of date Flash plugins are another vector. Just keep things updated and stop using IE. They also need a better antivirus. Norton and McAfee are worthless.
>>33496
No amount of anti virus will stop people from wanting to open the attached file on the email telling them they're today's lucky winner.
>>33489
I have'nt worked at a hospital, but I've done contract network admin stuff with a company that runs a bunch of those little walk in er things, and they have horrifyingly bad IS. I didn't say anything about the actual servers (Win server 2003) because I was just there to replace most of their network infrastructure at the local branches, but dear fucking god, a 10 year old script kiddy could have gotten patient data from that shit.
Like, they had active directory running on everything but didn't block the control port on the firewall (a shitty old router with builtin firewall software, not a real firewall)
It was sad as fuck
>>33581
No, but a half decent firewall will usually scan and quarantine malware quickly. Also company policy will usually note that unsolicited spam emails should be ignored.
>>33602
Malware analysis intern here, that's bullshit mate, it's very easy to bypass any initial AV scanning
>>33496
>Firefox with adblock and NoScript
Don't you mean Firefox with uBlock Origin and uMatrix?
>>33067
>Methodist Hospital
Can someone explain this to me, how can a hospital be religious? What does it mean?
>>33067 I don't understand why there isn't some proper organization (by all hospitals within one association) and regulation (by the government; for hospitals and manufacturers etc.) to prevent this.
If all hospitals don't have to reinvent the wheel and if it becomes a legal requirement and if it's subsidized by government I don't think that it would be THAT hard and costly to establish some proper protection for this.
They all have expenses because of this anyway - I really could flip when seeing how this isn't even remotely addressed by current society.
As of right now it's possible to hack life-supporting machines from anywhere in the world. They've got billions of dollars to surveil everyone's Internet activity but don't have a few million to get some of the most critical IT protection?
>it paid $17,00 to get access to files back.
wat. Did they pay 17 dollars for all their files?
>>33849
I know about uBlock buy what's the real advantage of uMtarix over NoScript?
>>33868
There is regulation, it's called HIPPA.
HIPPA just happens to be a bit of a joke. More over a CYA deal than real protection.
>>33861
>how can a hospital be religious?
It means the hospital was originally built and staffed as a part of a charitable mission by certain religious groups. They generally welcomed all comers regardless of belief.
As long as the religious group funds it, the services are free or heavily subsidized.
In the US however, many hospital boards dumped their religious affiliation over time and transformed from a charity-based hospital to a general hospital and began to charge patients. However they often kept the name.
In fact most hospitals worldwide, over the last two centuries, were religiously affiliated. Some of the most famous include: Cedars-Sinai (Jewish), St Jude Children's Research Hospital, Mayo Clinic (originally a St.Marys), New York Presbyterian, Hospital of St. Cross, St. Mary’s London, Hadassah Medical (Jewish) and Lambarene Hospital, who all began as religious charities. Add to that a shitload of Christian, Muslim and Buddhist hospitals across Africa, Europe, the Americas and Asia.
It wasn't until the advent of universal healthcare in the mid-twentieth century that secular institutions started to predominate.
This is what you get for letting staff download porn
>>33067
This is why I dont like giving my social securtiy number to fuck heads like this.
"oh got a broken leg, sure we can help. Just let me get your social into the system here"
why does it have to be in the system you fuck. just to the service you are paid to do and accept the payment.
>>33496
>all this ill-informed dribble
This shit would have been maybe half-accurate 4 years ago. Also
>>33795
This. There's even some web-based AV solutions out there (Webroot is one of them) that can be completely disabled just by setting whatever its upstream host is to loopback, literally the same way some pirates emulate validation servers for pirated software.
The heuristics of any AV solution is only as smart as the team writing it.
