In the ever-evolving landscape of cybersecurity threats, the healthcare industry finds itself under constant siege from malicious actors seeking to exploit vulnerabilities for financial gain or disruption. Recently, the Russian-speaking ransomware group Black Basta made headlines with its attack on Ascension, a Catholic health system. This incident underscores the urgent need for robust cybersecurity measures within healthcare organizations worldwide.
Components of the Attack
The Attack on Ascension:
Ascension’s ordeal began with the discovery of a cybersecurity event on May 8, ultimately confirmed as a ransomware attack the following day. This assault not only disrupted essential services but also caused a diversion for emergency medical services, highlighting the potentially life-threatening consequences of such attacks.
Identification of Black Basta:
Investigations revealed that Black Basta, possibly an offshoot of Conti, was behind the attack on Ascension. The threat posed by this group prompted the Health-ISAC to issue a warning to the healthcare sector, emphasizing the critical importance of implementing recommended security measures.
Health-ISAC’s Response: Health-ISAC’s threat bulletin urged healthcare entities to bolster their defenses by installing updates, implementing multifactor authentication, and enhancing user training to combat phishing attempts. Errol Weiss, chief security officer at Health-ISAC, stressed the need for additional resources to protect hospitals and healthcare systems globally.
Historical Context: Black Basta’s emergence as a threat to healthcare organizations was previously documented by the Health Sector Cybersecurity Coordination Center (HC3) in 2023. This attack serves as a stark reminder of the persistent and evolving nature of cybersecurity threats faced by the healthcare sector.
The Road to Recovery: While efforts are underway to restore systems at Ascension, a timeline for full recovery remains elusive. The organization’s focus on ensuring the safe restoration of services underscores the complex and challenging nature of recovering from such attacks.
Conclusion: The ransomware attack on Ascension by Black Basta underscores the urgent need for healthcare organizations to prioritize cybersecurity measures. As threats continue to evolve and grow in sophistication, proactive measures such as regular updates, robust authentication mechanisms, and comprehensive user training are essential to safeguarding sensitive patient data and ensuring uninterrupted delivery of critical healthcare services. This incident should serve as a wake-up call for the healthcare industry to invest in cybersecurity infrastructure and resources to mitigate the risk of future attacks. Start your disaster recovery conversation with MVR group to help mitigate in the event something similar happens to you. It is better to have a plan and not need it then not have a plan and need it.
Sources:
- https://www.hcinnovationgroup.com/cybersecurity/data-breaches/news/55040180/black-basta-behind-ransomware-attack-on-ascension
- https://about.ascension.org/cybersecurity-event
- https://www.hcinnovationgroup.com/cybersecurity/news/55038694/ascension-responding-to-cyber-attack
- https://www.hcinnovationgroup.com/cybersecurity/data-breaches/news/55039304/ascension-no-timeline-for-system-restoration-after-ransomware-attack
- https://www.cnn.com/2024/05/10/tech/cyberattack-ascension-ambulances-hospitals/index.html
- https://www.isao.org/group/h-isac/
- https://h-isac.org/black-basta-threat-actor-emerges-as-a-major-threat-to-the-healthcare-industry/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a
- https://www.hcinnovationgroup.com/cybersecurity/article/55019564/health-isacs-errol-weiss-what-leaders-need-to-do-now-around-cybersecurity
- https://www.hcinnovationgroup.com/cybersecurity/news/53028716/hc3-threat-profile-black-basta
- https://www.hhs.gov/sites/default/files/black-basta-threat-profile.pdf
