Ransomware Attack at Lake Charles Memorial Health System Impacts 270,000 Patients
Hackers accessed the personal data of nearly 270,000 patients in an attempted ransomware attack on Lake Charles Memorial Health System in Louisiana during October of 2022.
Lake Charles Memorial, which includes a 314-bed hospital, thwarted the hackers’ attempt to encrypt its computers and prevented any disruption to patient care, according to spokesperson Allison Livingston. The healthcare provider’s own security team detected the hack, Livingston said in an email.
The hack was disclosed in recent days as the network of hospitals notifies patients whose data was compromised. That includes patients’ health insurance information, medical records numbers and, in “limited instances,” Social Security numbers, according to the health system.
On their dark website for extorting victims, a ransomware gang known as Hive took responsibility for hacking Lake Charles Memorial and dumped data purporting to belong to the health system.
As of November, Hive ransomware had been used to extort about $100 million from over 1,300 companies worldwide – many of them in healthcare – the FBI and other federal agencies have warned.
“Healthcare continues to be an attractive for ransomware groups because even if a ransom isn’t paid, these attacks attract a lot of attention for the ransomware group, increasing their notoriety,” said Allan Liska, senior threat intelligence at cybersecurity firm Recorded Future.
Ransomware gangs such as Hive increasingly steal data from victim organizations before locking down computers in an attempt to increase their leverage in ransom negotiations. Some ransomware operators have “exploited stolen data to reach out to patients directly to demand payment under threat of having their patient records released,” Liska said.
While Lake Charles Memorial said its business operations were unimpeded by the hack, those of other key US and Canadian health care providers have been disrupted this holiday season.
SickKids, one of Canada’s largest children’s hospitals, said it could take weeks to fully restore its computer systems following a recent ransomware attack. The gradual recovery means “some patients and families may still experience diagnostic and/or treatment delays,” the hospital said in a statement.
Meanwhile, a network of three hospitals in Brooklyn, New York, had to work off paper charts for weeks following a cyberattack on its computer systems in late November.
Healthcare executives have grown much more aware of hacking threats in recent years and a cottage industry of cybersecurity specialists and consultancies have focused on improving the sector’s defenses.
But small hospitals in particular often lack consistent funding and personnel to protect their computer networks, according to experts. Sometimes volunteers try to fill the void. In the early days of the pandemic, a group of cybersecurity experts worked night shifts to help defend healthcare providers from hacks.
Ransomware attacks can threaten patient safety. A ransomware attack on a hospital already under strain from the Covid-19 pandemic and other crises can lead to “reduced capacity and worsened health outcomes,” according to a study from the Department of Homeland Security’s cybersecurity agency.