A woman needing urgent medical attention in Dusseldorf, Germany died last Thursday following an allegedly misdirected ransomware attack that crippled a hospital's IT systems.
According to the Associated Press, the hospital in question was the Dusseldorf University Clinic where it is believed hackers intended to target the Heinrich Heine University as opposed to the associated hospital.
Ransomware refers to orchestrated malicious software that encrypts the target's files and networks, preventing access unless the victim meets the attacker's demands.
The digital attack disabled access to 30 hospital servers, resulting in a gradual disruption of IT systems to the point where Dusseldorf University Clinic needed to send emergency patients to hospitals in neighbouring cities. Unfortunately, the delay in treatment led to the woman's death, where doctors were unable to see her for up to an hour after being sent to Wuppertal, approximately 32 kilometres from Dusseldorf.
In a sign the attack was meant to target the university, but not the hospital, the perpetrators reportedly retracted their ransom following contact from Dusseldorf authorities. While the identity behind the malicious act remains unknown, they are being investigated for negligent manslaughter.
Ars Technica reported that the attack targeted "CVE-2019-19781, a critical vulnerability in the Citrix application delivery controller, which customers use to perform load balancing of inbound application traffic".
Additionally, another Ars Technica article reported that 10 hospitals — including seven in Australia — were targeted in ransomware attacks in October last year. Some hospitals even went to the lengths of paying ransoms to regain system access. Data provided by Emisoft reveals 764 healthcare providers were hit by ransomware in just the US, let alone the rest of the world.
This callous act is despite several ransomware groups saying they will not hit health facilities, especially during the pandemic.
How magnanimous.
