US hospitals forced offline by reported Ryuk ransomware attack
Universal Health Services employees have been told IT issues could go on for days
Universal Health Services (UHS), one of America's largest healthcare providers, has been hit by an alleged ransomware attack.
The company's IT networks have been taken offline by what is thought to be another case of Ryuk ransomware.
The most popular ransomware strains targeting UK businesses Selective ransomware Ryuk nets $4m from big businesses Spanish Ryuk ransomware attack hints at new WannaCry
Despite being relatively new, Ryuk has quickly built a fearsome reputation for attacks on enterprise-level businesses. It is ransomware that uses encryption to block access to a system until a ransom is paid.
This strain of malware hit UHS systems on Sunday, according to reports, shutting down its IT networks and forcing its workers to use "offline documentation". UHS provides healthcare for profit at some 400 hospitals and facilities across the US and in the UK.
"The IT network across Universal Health Services facilities is currently offline due to an IT security issue," the organisation said in a statement. "We implement extensive IT security protocols and are working diligently with our IT security partners to restore operations as quickly as possible."
One hospital worker told TechCrunch that their computer screen changed with text that referenced the "shadow universe", which is often the case with Ryuk ransomware attacks.
"Everyone was told to turn off all the computers and not to turn them on again," the unnamed person said. "We were told it will be days before the computers are up again."
It is not immediately known what effect the attack is having on patient care, or how widespread the infection is, but UHS has said that "no patient or employee data appears to have been accessed, copied or otherwise compromised".
Although the exact origin of Ryuk is unknown, it has been linked to a Russian cyber crime group called WizardSpider, which are known to go "big game hunting" - meaning they target larger organisations.
A number of Spanish organisations were hit by the ransomware earlier in the year, and there are fears it could lead to 'WannaCry' levels of disruption.
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
