We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Attackers demand ransom after encrypting medical centre's server

New type of data breach attack spotted in US

Details have emerged of an extraordinary data breach incident in which a US medical practice had thousands patient records and emails encrypted by attackers who then demanded a ransom to unscramble the data.

The incident appears to have come to light after a security blogger 'Dissent Doe' noticed a data breach report made by Illinois-based The Surgeons of Lake County medical centre to the US Department of Health and Human Services.

According to a small newswire that reported events, attackers were able to compromise one of the medical centre's servers, encrypting its contents including 7,067 patient records and a quantity of emails.

The first the centre knew about the attack was on 25 June when a ransom note for an undisclosed sum was posted on the server, at which point it was turned off.

It is not clear whether the data was recovered through backups but the organisations reported the incident to the police and Department of Health.

"Safeguarding every patient's personal information is a top priority at The Surgeons of Lake County. We are devoting significant people and technological resources to help protect patient confidentiality," the centre's president Dr Scott Otto said in an official statement at the time.

What marks the compromise out from almost every data breach attack recorded is that the attackers opted to extort the victim organisation rather than attempting to sell or exploit the data itself.

It remains unlikely that the intention was to abuse this data directly; having occurred only days before the extortion note was received, the criminals would normally want a longer period to execute data and identity theft crimes. Most data theft criminals attempt to go undetected for this reason.

The criminals will, nevertheless, had access to sensitive data including names, addresses, social security and credit cards numbers plus medical records, prompting the centre to inform its affected patents of the breach.

"This is a warning bell. Maybe they're the canary in the coal mine that unpredictable things can happen to data once it's digitized," said Santa Clara University law school professor, Dorothy Glancy, quoted by Bloomberg.


IDG UK Sites

Best Christmas 2014 UK tech deals, Boxing Day 2014 UK tech deals & January sales 2015 UK tech...

IDG UK Sites

LED vs Halogen: Why now could be the right time to invest in LED bulbs

IDG UK Sites

Christmas' best ads: See great festive spots studios have created to promote themselves and clients

IDG UK Sites

Why Apple shouldn't be blamed for exploitation in China and Indonesia