FBI warns ransomware assault threatens US healthcare system

AP Technology Writer


In a joint alert Wednesday, the FBI and two federal agencies warned that they had "credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers." The alert said malicious groups are targeting the sector with attacks that produce "data theft and disruption of healthcare services."


The offensive by a Russian-speaking criminal gang coincides with the U.S. presidential election, although there is no immediate indication they were motivated by anything but profit. "We are experiencing the most significant cyber security threat we've ever seen in the United States," Charles Carmakal, chief technical officer of the cybersecurity firm Mandiant, said in a statement.









"One of the comments from the bad guys is that they are expecting to cause panic and, no, they are not hitting election systems," Holden said. "They are hitting where it hurts even more and they know it." U.S. officials have repeatedly expressed concern about major ransomware attacks affecting the presidential election, even if the criminals are motivated chiefly by profit.

Mandiant's Carmakal identified the criminal gang as UNC1878, saying "it is deliberately targeting and disrupting U.S. hospitals, forcing them to divert patients to other healthcare providers" and producing prolonged delays in critical care. 

He called the eastern European group "one of most brazen, heartless, and disruptive threat actors I've observed over my career." 

While no one has proven suspected ties between the Russian government and gangs that use the Trickbot platform, Holden said he has "no doubt that the Russian government is aware of this operation — of terrorism, really." He said dozens of different criminal groups use Ryuk, paying its architects a cut.

Dmitri Alperovitch, co-founder and former chief technical officer of the cybersecurity firm Crowdstrike, said there are "certainly lot of connections between Russian cyber criminals and the state," with Kremlin-employed hackers sometimes moonlighting as cyber criminals. 


Sky Lakes acknowledged the ransomware attack in an online statement, saying it had no evidence that patient information was compromised. It said emergency and urgent care "remain available" The St. Lawrence system did not immediately return phone calls seeking comment.



