European health care giant Fresenius Group grappling with computer virus

Fresenius Group, a health care conglomerate that includes a major pharmaceutical firm, said the incident affected some of its production.

Fresenius Group, a big European health care conglomerate, said Wednesday that a computer virus had infected at least one of its businesses’ IT systems. It’s another sign that malicious hackers see medical organizations as fair game despite a global health crisis.

The Germany-based corporation said the security incident had hampered some production in its pharmaceutical business, Fresenius Kabi, which makes everything from nutritional products and infusion therapies to pain relievers that are in high demand during the coronavirus pandemic.

Fresenius Group spokesperson Steffen Rinas declined to specify which production units were affected by the malware. He did say that Fresenius’s hospitals — said to be the largest private network in Europe — were not affected by the incident. The company did not specify the nature of the virus.

“As a precautionary measure in accordance with the security protocol drawn up for such cases, steps have been taken to prevent further spread,” Rinas said in an email. “Nevertheless, our production continues with certain limitations. Also, our patient care continues. Our IT experts are continuing to work on solving the problem and ensuring that operations run as smoothly as possible.”

Reports from independent journalist Brian Krebs and German technology news outlet Golem said the computer virus was ransomware, raising the possibility that Fresenius would have to negotiate with hackers or rebuild its systems.

There were also signs the malware had spread to other parts of Fresenius’s corporate empire, which reported $38 billion in sales for 2019. The malicious code affected Fresenius’s pharmaceutical business in Norway, according to Norwegian newspaper Halden Arbeiderblad. The company has a factory in Halden, south of Oslo, that produces pharmaceuticals.

Rinas, the Fresenius Group spokesperson, said the Norwegian plant was continuing production “with certain limitations.” He declined to elaborate.

Criminal and government-linked hackers have consistently looked to hack health care organizations and government bodies responding to the COVID-19 crisis. Criminals typically hack these organizations to try to extort them; multiple ransomware attacks on companies involved in pandemic response have been reported.

Spies, on the other hand, are looking for intelligence or to steal information that can help treat the virus. With a vaccine for the respiratory disease likely still many months away, U.S. and U.K. cybersecurity officials on Tuesday warned that government-linked hackers would continue to target medical organizations.

Bipartisan health care cybersecurity legislation returns to address a cornucopia of issues

The bill, first introduced late last year, deals with regulations, training, grants and more.

FBI, CISA, Treasury: North Korean hackers taking aim at health care with Maui ransomware

Irish officials warn of ongoing disruptions to health system, long recovery following ransomware incident

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure