The IT Nerd

Hospitals are really important right now given the times we currently live in. Which makes news of a cyberattack on Toronto’s Humber River Hospital incredibly frightening. And a group of ER doctor’s want the ER closed until things are back to normal:

A group of emergency physicians at Humber River Hospital has written a letter to the hospital’s administrators calling for the emergency department to be temporarily closed until IT systems are fully restored, citing concerns over patient safety.

The hospital’s information technology system has been shut down since Monday following an early-morning ransomware attack that triggered a Code Grey, or loss of essential services.

The IT shutdown has led to delays in medical and diagnostic test results needed to assess patients, according to the physicians who authored the letter obtained by the Star.

“This is leading to compromised and dangerous conditions for our patients,” the letter reads. 

The authors want “normal activities in the emergency department to cease until our IT systems are restored to normal function,” noting patients could travel to nearby GTA hospitals that “can operate at the proper level of care.”

However the hospital says things are safe:

In an interview with the Star, Dr. Leon Rivlin, chief and medical director of the emergency department, said the hospital has “continued to deliver care to all of our patients in a very safe way” during the ongoing Code Grey. 

The emergency department is now safely relying on paper records while assessing patients, he said. It’s also working closely with the diagnostic and laboratory departments “to ensure that we are maintaining all of the efficiencies and the safety mechanisms that have been developed in order to make sure patients get the care that they need,” Rivlin said.

The problem is that this could easily become one of those situations where everything is fine until it isn’t. And then it will go very bad for the hospital and more importantly, the patients. Hopefully we don’t see that scenario play out and things get back to normal quickly.

Also, I hope there’s an explanation of what happened here, and more importantly, what the hospital will do to stop something like this from happening in the future.

You might recall that I wrote about the data from millions of Volkswagen and Audi getting out in the wild. Now the situation has gotten worse. On Monday, hackers put the data stolen from the car maker on sale on a notorious hacking forum:

In the sales listing reviewed by Motherboard, a hacker that goes by 000 wrote that the data included email addresses and Vehicle Identification Numbers (VIN). The hacker also posted two samples of the data, which included full names, email addresses, mailing addresses, and phone numbers. The type of data seems to align with what Volkwagen admitted was stolen. In a website set up by a cybersecurity vendor on behalf of the car maker, Volkswagen said that “the majority” of affected data included: “first and last name, personal or business mailing address, email address, or phone number. In some instances, the data also included information about a vehicle purchased, leased, or inquired about, such as the Vehicle Identification Number (VIN), make, model, year, color and trim packages.” 

But for 90,000 victims, the data also included “more sensitive information relating to eligibility for a purchase, loan, or lease. Nearly all of the more sensitive data (over 95%) consists of driver’s license numbers,” according to the company, which added that the majority of data pertains to Audi customers and interested buyers in the US and Canada only. The company also said it believes the data was left unsecured by a vendor. (Audi is owned by the Volkswagen Group.) “There were also a very small number of dates of birth, Social Security or social insurance numbers, account or loan numbers, and tax identification numbers,” the website read.

This situation requires a strong response from authorities. As in Volkswagen needs to be punished for this severely as letting this data out into the wild is completely unacceptable. Hopefully that punishment is coming swiftly.

Here’s something that doesn’t happen every day. Police in Ukraine said this week they arrested members of a major ransomware gang:

The arrests mark the first time a law enforcement agency has announced a mass arrest of a prolific hacker group that had extorted Americans by either encrypting an organization’s files or threatening to leak them to the public. The gang, known as Cl0p, has hacked a number of American targets, including the University of Miami, Florida, Stanford University, University of Maryland, and University of Colorado, demanding a payment to either keep their systems functional or to not publish material they were able to steal. The bust comes as ransomware has gone from a quietly pervasive cybersecurity problem to a broadly discussed national security issue, thanks to a series of high-profile attacks that have threatened to cripple some U.S. supply chains.

Ukraine’s announcement coincided with President Joe Biden’s meeting with Russian President Vladimir Putin in Geneva. Biden is expected to press Putin to take action against ransomware hackers who operate with impunity within Russia’s borders. Ransomware has become a significant problem in the United States. Recent ransomware attacks briefly hobbled the Colonial Pipeline, shutting down the country’s largest fuel pipeline for five days, and JBS, one of the country’s largest meat suppliers. The majority of the most prolific ransomware gangs are believed to operate in Eastern Europe, and Russia in particular. Ukraine’s cyber police announced they had arrested six people involved with Cl0p, and seized a number of computers, cars and about 5 million Ukrainian hryvnia ($185,000) in cash.

Here’s why I am cynical about this. This is one of dozens of gangs that buy and use ransomware software. The timing might not be a coincidence though. The best that I can perhaps see coming out of this is that at most it’s a warning to the other gangs that they could be next. But only if cops follow up and bust more gangs. We’ll have to wait to see if this is or isn’t anything more than a flash in the pan.

In light of the recent wave of high-profile ransomware attacks that have caused havoc in the US and Europe, the member states of the G7 group have called on Russia and other countries to crack down on ransomware gangs operating within their borders:

“We call on all states to urgently identify and disrupt ransomware criminal networks operating from within their borders, and hold those networks accountable for their actions,” the G7 group said in a communique published on Sunday, at the end of a three-day conference held in Cornwall, UK. “In particular, we call on Russia […] to identify, disrupt, and hold to account those within its borders who conduct ransomware attacks, abuse virtual currency to launder ransoms, and other cybercrimes,” the G7 group added.

The joint statement was signed by the governments of Canada, France, Germany, Italy, Japan, the UK, and the US — more commonly known as the Group of Seven (G7). It comes after a series of ransomware attacks that caused disruptions at hospitals during the COVID-19 pandemic, fuel outages on the US East Coast following the Colonial Pipeline attack, and beef supply issues across Australia and the US following the JBS Foods ransomware incident.

This isn’t going to happen. Russia, China, and others who shield these gangs aren’t going to do anything about these gangs simply by being asked nicely by the G7. This is state sanctioned activity. Which means you need to punish the states in question via sanctions and other means. Then and only then they might change how they treat ransomware gangs. So maybe the G7 should rethink this and come up with a plan that makes these states feel some real consequences.

NBC reports that the Teamsters labor union was hit by a ransomware attack demanding $2.5 million back in 2019. But unlike a lot of companies out there, they decided to tell the scumbags behind the attack to take a hike and not pay them. This despite the FBI at the time telling them to pay up:

Personal information for the millions of active and retired members was never compromised, according to a Teamsters spokesperson, who also said that only one of the union’s two email systems was frozen along with other data. Teamsters officials alerted the FBI and asked for help in identifying the source of the attack. They were told that many similar hacks were happening and that the FBI would not be able to assist in pursuing the culprit. 

The FBI advised the Teamsters to “just pay it,” the first source said. “They said ‘this is happening all over D.C. … and we’re not doing anything about it,'” a second source said.

Union officials in Washington were divided over whether to pay the ransom — going so far as to bargain the number down to $1.1 million, according to the sources — but eventually sided with their insurance company, which urged them not to pony up… The Teamsters decided to rebuild their systems, and 99 percent of their data has been restored from archival material — some of it from hard copies — according to the union’s spokesperson.

The FBI’s communications office did not reply to repeated requests for comment. The FBI’s stance is to discourage ransomware payments.

Clearly the Teamsters are made of tougher stuff than most. They were willing to rebuild everything rather than pay up. And I applaud them for that. This should be a case study for every other company out there of what to do when you get attacked by ransomware. If more companies do what the Teamsters did, the scumbags behind ransomware attacks would be out of business tomorrow.