Recent research titled “Moving Forward: Setting the Direction” highlighted that healthcare supply chain security is one of the lowest-ranked areas for the National Institute of Standards and Technology’s Cybersecurity Framework (NIST CSF) conformance. According to the research, only 44% of hospitals and health care providers are following the security protocols outlined by the NIST framework. And the healthcare industry does not seem to have learned much from this report. Yet another med-tech company – Elekta – has been allegedly hit by a cyberattack that has delayed scores of cancer patients from getting radiology treatment in the U.S.
The Attack
The cyberattack first grabbed headlines in the first week of April when a division of 12 News reported that two healthcare providers had to reschedule their cancer patients’ treatment appointments due to an “outage.” The outage was due to a cyberattack on their common service provider – Elekta – which hosted the hospital networks’ radiation oncology cloud service.
The Aftermath
The immediate effect of the attack was that appointments of at least 50 patients at Southcoast Health’s cancer centers in Fall River and Fairhaven and an unknown number of patients at Rhode Island Hospital and the Lifespan Cancer Institute in East Greenwich had to be canceled and rescheduled. On learning about the cyberattack, the company took immediate measures to contain it and reported it saying that only a smaller “subset of U.S-based customers are affected.” However, the HIPAA Journal seems to suggest otherwise. According to their report, “around 170 customers in the U.S. that use its first-generation cloud system experienced service disruptions to one or more of their products.”
It further added that Connecticut-based Yale New Haven Health, who was also Elekta’s customer, was forced to take its radiation equipment offline until the issues were resolved.
The Remediation Steps
Elekta provides cloud-based software that is used to control linear accelerators for radiation treatments of cancer patients. However, the system service provider still works on the first-generation cloud-based storage system which eventually led to the said security compromise. Citing this issue, Elekta immediately initiated the process of migrating its customers to its new Microsoft Azure cloud and has been working around the clock to complete the process.
Closing Notes
Elekta did not give details about the exact nature of the attack and thus it is still unclear as to what type of malware was used in the cyberattack. However, looking at the recent history of ransomware attacks being precisely targeted at the healthcare sector, this could well be the job of a ransomware gang.
It is not only time to pay attention to the cybersecurity of your hospitals and clinics but also the entire healthcare ecosystem, including third-party service providers.
Related News:
How Cyberattacks Cause Severe Hazards to Health Care Industry
