Indian Hospitals are under continuous cyber attacks

There are Millions of cyber-crimes reported across the world every day. In India, we find more than 10,000 cyber-crimes registered with different police and other agencies every day. Whereas, there are several thousands of cybercrimes which are not reported, since they feel that there may not be any respite to them. Despite being a global crime, worldwide hospitals are facing the hacking of their records—dysfunction of their systems etc.

The recent attack on hospitals, educational institutions or any important use of public essential service, more so on hospitals, is not only a crime against humanity but a murderous attempt on the lives of hundreds of patients, students, and researchers.

According to the report, the U.S. overwhelmingly focuses its cybersecurity concerns on the "big four" nation-state adversaries — China, Russia, Iran and North Korea — non-state actors are becoming increasingly organized and efficient in cyber warfare.

On November 23rd there was a cyberattack that immobilized AIIMS' e-hospital system – including appointments and registration at outpatient departments, billing at inpatient departments, laboratory report generation, and smart lab, among others.

The server of All India Institute of Medical Sciences Delhi remained hacked for more than nine days. It is feared that the data of around 3-4 crore patients could have been compromised due to the breach. The System is yet to be fully restored as more damage is anticipated if it is linked to the Internet; attackers changed file extensions for all physical servers; over 11,000 computers to be scanned.

The file extensions for all the physical servers of AIIMS running on Operating System Linux were changed by the ransomware attackers, a probe has found. The users asked AIIMS officials that they could send “program and private key” to the IT department of AIIMS to “decrypt the data” and warned the officials to not use third-party software to repair the system as it may lead to permanent data loss.

After AIIMS Delhi, another top hospital in the national capital Safdarjung Hospital faces the cyberattack. As per the officials, the damage was not as severe as it had been for the AIIMS hospital. The server was down for a day, but data was secured.

There was another cyberattack to a hospital in Chennai that came to the notice, where the personal data of 1.5 lakh patients from Tamil Nadu’s Sree Saran Medical Center was sold by hackers on popular cybercrime forums and a Telegram channel used to sell databases. The hackers shared a sample as proof for potential buyers to inspect the authenticity of the data. The leaked data contains names of the patients, birth dates, addresses, guardian’s names and doctor’s details.

The investigation into the incident of hacking of computers and servers at AIIMS has pointed towards the role of China-based hackers. After various security agencies of the country joined to rescue AIIMS against extortion and cyber terrorism, the investigation has confirmed that five main servers were targeted by the Chinese hackers who subsequently put it on the dark web.

Healthcare organizations deal with vast amounts of personal and private data, which can be hugely valuable for criminals and terrorist groups. So, Hospitals, pharmacies, care centres and other healthcare organizations are prime targets for cyber-criminals. Healthcare organizations always take it easy; sometimes, they need help investing in the latest security technologies, making them easy targets for cyber-crime, from scams to sophisticated ransomware.

Now the obvious question that arises is, are we prepared to face cyber theft and crime?

International or domestic law is still under development regarding how to control mega cyber-crimes. Notwithstanding some new international and domestic laws, it remains a significant challenge to identify, control and arrest criminals beyond geographical boundaries.

S Mohini Ratna, Editor, VARINDIA