I learned a new IT term this week: ransomware. Ransomware is malicious software that blocks access to a computer system until a ransom is paid. Although it was news to me, ransomware is not new; the earliest known use was back in 1989, when the ransom had to be paid via PO Box. The attacks are now much more sophisticated and significantly on the rise. The latest salvo – and the one that brought ransomware to my attention – was the recent attack on Hollywood Presbyterian Medical Center.
The hospital discovered at the beginning of February that hackers had infiltrated its computer system and encrypted all of its data, “blacking out” the hospital’s electronic medical record system. The hackers demanded 40 bitcoins (an untraceable virtual “currency”), worth about $17,000, to unlock the data. After ten days of using pen and paper and fax machines to maintain patient records, the hospital paid up. In a statement, they explained that “the quickest and most efficient way to restore our systems and administrative functions was to pay the ransom and obtain the decryption key. In the best interest of restoring normal operations, we did this.”
Hollywood Presbyterian claims that patient care was not impacted and that no patient data was compromised. Despite these assurances, the possibility of hackers taking patient information hostage is alarming; it will also be interesting to see if a HIPAA audit follows on the heels of Hollywood Presbyterian’s revelation.
Some experts note that the frequency of ransomware attacks is probably much higher than we realize, as most victims – even large institutions – will pay up quietly and never publicly acknowledge the hack.
Hollywood Presbyterian notified law enforcement after they paid the ransom. The FBI is investigating.