Skip to main content Skip to navigation

US hospital systems facing 'imminent' threat of cyber-attacks, FBI warns

This article is more than 1 year old

An alert said malicious groups are targeting the healthcare sector with attacks designed to lock up information systems and steal data

The FBI warned that the US healthcare system is facing an ‘imminent’ cybercrime threat.
The FBI warned that the US healthcare system is facing an ‘imminent’ cybercrime threat. Photograph: J David Ake/AP

Federal agencies have warned that the US healthcare system is facing an “increased and imminent” threat of cybercrime, and that cybercriminals are unleashing a wave of extortion attempts designed to lock up hospital information systems, which could hurt patient care just as nationwide cases of Covid-19 are spiking.

In a joint alert on Wednesday, the FBI and two federal agencies warned that they had “credible information of an increased and imminent cybercrime threat to US hospitals and healthcare providers”. The alert said malicious groups are targeting the sector with attacks that produce “data theft and disruption of healthcare services”.

The cyber-attacks involve ransomware, which scrambles data into gibberish that can only be unlocked with software keys provided once targets pay up. Independent security experts say it has already hobbled at least five US hospitals this week, and could potentially affect hundreds more.

The offensive by a Russian-speaking criminal gang comes less than a week ahead of the election, although there is no immediate indication they were motivated by anything but profit.


Alex Holden, CEO of Hold Security, which has been closely tracking the ransomware in question for more than a year, agreed that the unfolding offensive is unprecedented in magnitude for the US, given its timing in the heat of a contentious presidential election and the worst global pandemic in a century.



In September, a ransomware attack hobbled all 250 US facilities of the hospital chain Universal Health Services, forcing doctors and nurses to rely on paper and pencil for record-keeping and slowing lab work. Employees described chaotic conditions impeding patient care, including mounting emergency room waits and the failure of wireless vital-signs monitoring equipment.


Holden said he alerted federal law enforcement on Friday after monitoring infection attempts at a number of hospitals. He said the group was demanding ransoms well above $10m per target and that criminals involved on the dark web were discussing plans to try to infect more than 400 hospitals, clinics and other medical facilities.


Carmakal described the eastern European group as “one of most brazen, heartless, and disruptive threat actors I’ve observed over my career”.


While no one has proven suspected ties between the Russian government and gangs that use the Trickbot platform, Holden said he has “no doubt that the Russian government is aware of this operation – of terrorism, really”. He said dozens of different criminal groups use Ryuk, paying its architects a cut.