Philadelphia-area health system says it 'isolated' a malware attack

Attackers behind the NetWalker ransomware claimed responsibility.

A “malware attack” has hit computer systems at Crozer-Keystone Health System, a large health care provider in the Philadelphia suburbs, a spokesman for the organization said Friday.

“After quickly identifying a recent malware attack, the Crozer-Keystone information technology team took immediate action and began remediating impacted systems,” Crozer-Keystone’s Rich Leonowitz said in an emailed statement.

Crozer-Keystone owns four hospitals and four outpatient centers in Delaware County, Pennsylvania, according to its website. It was not immediately clear how, if at all, the cybersecurity incident impacted those facilities. Leonowitz declined to answer questions on the matter.

“Having isolated the intrusion, we took necessary systems offline to prevent further risk,” Leonowitz’s statement continued. “We completed this work in collaboration with cybersecurity professionals across our health care system and are currently conducting a full investigation of the issue.”

A set of hackers behind the NetWalker ransomware claimed responsibility for the attack. On their victim-shaming website, the hackers shared screenshots that they claimed were encrypted files belonging to Crozer-Keystone. A countdown clock on the site threatens to publicly dump the data in six days unless the hackers are paid a ransom. The dual threat of extorting organizations and dumping data is an increasingly common tactic from ransomware perpetrators.

A sector under stress

It’s just the latest cybersecurity incident to hit the health care sector during the novel coronavirus pandemic. The IT systems at the Czech Republic’s second biggest hospital suffered a cyberattack in March. There have also been ransomware attacks on pharmaceutical and biotech firms helping respond to the coronavirus.

“With ransomware becoming a public health threat to health care systems overburdened during COVID-19, it should be treated as such,” said Beau Woods, a cyber safety innovation fellow at the Atlantic Council.

The hackers behind NetWalker are relatively new to the ransomware scene, but “have been very innovative during their short operational period,” said Allan Liska, a threat intelligence analyst at security company Recorded Future.

“Some of the NetWalker groups have been particularly aggressive in targeting health care providers and they appear to be successful at extracting ransom from these targets as very few have made it to their extortion site,” Liska added.

In March, a NetWalker ransomware attack temporarily disabled the website of a public health agency in Illinois that was updating residents on the spread of coronavirus.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure