Malware and Ransom of Medical Records

"The doctors are under attack. We are getting physicians on a regular basis saying, 'I have a computer, I got locked out, I have ransomware'."
"They've been asked to pay in bitcoin. They're asking us, 'Should I pay it'?"
Dr. Dennis Desai, physician-adviser, Canadian Medical Protective Association (CMPA)

No Canadian hospital -- as opposed to a doctor's office -- has yet made a public admission that they have become a victim of ransomware, their computer systems with invaluable and private patient records falling victim to cyberattack through malware, finding themselves locked out of their source of record-keeping and maintenance, and faced with the prospect of having to shut down operations unless they surrender to the demands of Internet pirates.

"There have been some hospitals that have been attacked and have paid ransom in bitcoin, in Canada."
"It was the Wannacry kind of event ... It's not individual patient files; they lock up everybody."
Bill Tholl, chair, federal committee on cybersecurity and critical infrastructure

This week the CMPA, the agency whose purpose it is to provide liability coverage for Canadian doctors published an article to make doctors aware of this growing problem of computer system attacks and to urge their member-physicians to make certain they maintain robust backup systems, and take urgent steps to guard against infection through computer viruses. Above all, to refuse to pay ransom should they be targeted.

The problem is a real one, and it is a growing phenomenon of some urgency. One expert has estimated that the number of ransomware attacks perpetrated on this target audience has risen by 600 percent in the past year alone, according to Mr. Tholl, previously CEO of HealthCareCan, an entity which represents hospitals and allied medical facilities. Precisely for the very reason that sensitive medical data has become a prime focus, more so even than efforts to bog down banking enterprises.

The simple reality now appears to be that hackers repeatedly target Canadian doctors with their ransomware and in so doing render their computer systems with their thousands of critical and sensitive medical records hostage, impeding the normal care of patients. Once the situation has been
settled it takes days for medical offices to restore their systems from their backup sites. In the process the potential for loss of crucial data looms.

Physicians are hard put to ensure that nothing is missing in their patients' history when health issues are being diagnosed. Ontario's privacy commissioner office has received ten reports of such ransomware attacks on medical clinics or doctors' offices since 2016, recognizing it as an "increasingly dangerous" threat to the security of health records.

A cyber gang - called Shadow Brokers - is being blamed for the hack Credit: Reuters

When computers are frozen by encrypting data, the anonymous attackers demand payment, most often in digital bitcoin before they will unlock the files. The notorious Wannacry virus struck 15 hospitals in Britain's National Health Service, forcing them to shut down some of their operations. Two major health facilities in the United States were similarly struck by such attacks; computers at Erie Country Medial Center in Buffalo went down for six weeks while the authorities there refused to pay the demand of $44,000 in bitcoin to free the computers.

To the present, according to cybersecurity consultant Kevin Magee, Canadian hospitals have managed to evade the problems that assailed hospitals in Britain and the U.S., crediting their more disciplined approach to installing security patches in protection against malware. Cyber criminals, however, were encouraged by their success in pursuing health-care institutions for ransom; when lives are endangered, desperate efforts to regain control of critical files have led to the ransom being paid.

Over 70 percent of physicians have engaged with electronic medical records. The absence of that critical data for even a few days while the computers are being forcibly locked down spells a huge problem for health practitioners, when computer systems cover all record-keeping from appointment schedules to detailed patient charts.

Skids Cybercrime

"Kids are more knowledgeable than their parents. What they have access to and the different forums they can go to, and the different things they can access, it would probably scare the average parent."
"These kids have this access to these forums and other places where they can get these kits with the malware and target things with it. It is a means for them to lash out and do things that are nefarious or cause a lot of angst with businesses and government organizations."
"Mom and Dad are out working and trying to make ends meet, and the kids have access to mobile devices and you name it, and they could be going into these darker areas to do bad things. If you look at what's going on in the market today, a lot of these kits are being provided to anybody who wants them. You can actually go to YouTube and find videos about how to use these malware kits."
"We encourage parents to start early, talking to your children about what it's like to be a good Net-citizen. Teach them good ethics and values so that they stay away from this. This is a challenging time for us."
Gary Davis, chief consumer security officer, McAfee, Intel Security

Why make anonymous telephone calls to people in the middle of the night, waking them from sound sleep to emit over the telephone ungodly laughter and send chills down their spines, or call them at dinnertime to ask whoever answers how they might respond to an innocent query then slap an insolent response in their ears to deafening laughter, when you can aim higher and mess up their computers? And why even focus on individual computers when you can access servers and websites making government agencies and big corporations scramble in panic at their Internet security compromised?

For smart young kids looking for a new kind of challenge in a new kind of universe, the World Wide Web has it over all other types of prospective mischief-making. And if the youths are looking to discharge their sense of social alienation and rage they can do quite a bit of damage to satisfy their sense of grievance. Cyber espionage is a problem, all right, with countries underwriting secret code enterprises and malware enabling commercial and national interests to be compromised. But the growing incidence of computer-literate youth with axes to grind also represent danger.

Website hijacking, swatting, credit card theft, fraud, the malicious spread of malware is increasingly engaged on by "script kiddie" enterprise. In Internet circles they're identified as "skid" attacks for the damage they cause to public institutions, government agencies, financial institutions, corporations in their search for victims and access to systems that have weak spots they are able to take advantage of. And, ultimately carefully boast about, adding to their credentials as nuisance predators online and in business.

The public furore as government agencies admit that their websites have been compromised, as businesses divulge that private customer data may have been compromised, appears to reward some nasty little impulse at the back of some peoples' minds where once they got their thrills stealing lawn furniture, hoisting it up onto roofs, or carrying it into public parks to be retrieved, or not, by the fuming owners. These website assaults are simply the 21st Century equivalent, the adventure calling to the little addicts of social maladaption.

Teenage bullies framing the victim for a hack that disrupted their privacy leading the victim to reach out on social media to explain that digital attacks were perpetrated by the very one who now accuses him of what he had suffered, and hoping that his story sounds believable enough. Access to high-speed Internet makes available a veritable stable of tools and anonymity services enabling even a kid with borderline technical skills to become a threat.

In 2014 McAfee Labs identified over 300 new threats surfacing each and every minute; over five new viruses, worms and threats per second. Malware surged by 76 percent year after year. Just as technology powers itself forward into new frontiers at lightning speed, so too do the malignant devices to baffle and infuriate the users of the technology rack up their diligent advances into a scarring enterprise. Sometimes, the parents who profess shame and surprise at their offsprings' devious dealings have themselves taught their kids computer science techniques.

As was the case with a 19-year-old university student from London, Ontario whose father is a university professor of computer science whose son became conversant with the Heartbleed vulnerability to break into Canada Revenue Agency servers. That data breach resulted in hundreds of Social Insurance Numbers along with tax information being stolen from the servers. That student now faces charges of mischief and unlawful use of a computer, charges that don't really sound equal to the serious nature of the attacks.

When a teenager from an Ottawa suburb was arrested for involvement in swatting calls -- false 911 calls to police -- all over North America, it was revealed in subsequent newspaper stories that his father is a computer technician who denies his son's involvement, insisting despite evidence to the contrary that the investigation represented a witch-hunt targeting his innocent child.

Cyberbullying represents yet another social problem of huge dimensions. Dosomething.org, an online youth-focused organization with over 3.1 million members globally reports that 43 percent of youth online report having been a victim of cyberbullying.