New Delhi: Ascension, one of the healthcare giants in the US, has revealed that in May 2024, it was hit by a ransomware attack, which impacted its electronic health records system, phones, and scheduling systems.
While some non-emergent procedures and appointments were delayed, emergency services were diverted to avoid backlogs.
How hackers got hold of company data
The attack was executed after an employee downloaded a malicious file believed to be legitimate. The company took some devices offline on May 8 to contain the incident and switched to paper-based recordkeeping for procedures and medications.
“We have also identified how the attacker gained access to our systems. An individual working in one of our facilities accidentally downloaded a malicious file that they thought was legitimate. We have no reason to believe this was anything but an honest mistake,” the company said.
While some services are back online, Ascension is still working to restore full functionality of electronic health records, patient portals, phone systems, and scheduling systems.
“Importantly, we have no evidence that data was taken from our Electronic Health Records (EHR) and other clinical systems, where our full patient records are securely stored,” it added.
What the company has found
In an investigation, the company found that attackers accessed and potentially stole files from seven servers out of Ascension’s network of 25,000. These files may contain patient Protected Health Information (PHI) and Personally Identifiable Information (PII).
“We have made progress in our investigation and recovery with the help of third-party cybersecurity experts. At this point, we now have evidence that indicates that the attackers were able to take files from a small number of file servers used by our associates primarily for daily and routine tasks. These servers represent seven of the approximately 25,000 servers across our network,” it added.
Bleeping Computer reports that while Ascension hasn’t identified the specific ransomware group, CNN reported Black Basta’s involvement.
Black Basta is a ransomware group that has been active since April 2022 and has targeted high-profile organisations like Rheinmetall, Capita, ABB, and the Toronto Public Library.
