Kentucky hospital hit by ransomware attack

A month after a Los Angeles hospital was crippled by crypto-ransomware, another hospital is in an "internal state of emergency" for the same reason. Brian Krebs reports that Methodist Hospital in Henderson, Kentucky, shut down its desktop computers and Web-based systems in an effort to fight the spread of the Locky crypto-ransomware on the hospital's network.

Yesterday, the hospital's IT staff posted a scrolling message at the top of Methodist's website, announcing that "Methodist Hospital is currently working in an Internal State of Emergency due to a Computer Virus that has limited our use of electronic web-based services. We are currently working to resolve this issue, until then we will have limited access to web-based services and electronic communications." As of this morning, the message has been taken down from the site.

Methodist Hospital's information systems director told Krebs that the Locky malware, which came in as an attachment to a spam e-mail, attempted to spread across the network after it had infected the computer it was triggered on. Locky has been known to use malicious scripts in Microsoft Office documents as a means of infecting victims' computers. The malware succeeded in infecting several other systems, prompting the hospital staff to shut down all the hospital's computers. Each PC is brought back online individually after being scanned for telltale signs of Locky while off the network.

The message left on the affected systems by the operator of the Locky malware demands a ransom of four bitcoins—about $1,600 or £1,200. David Park, an attorney for the hospital, told Krebs that the hospital may pay the ransom. “I think it’s our position that we’re not going to pay it unless we absolutely have to,” Park said. He also confirmed that the hospital is working with the FBI.

Hollywood Presbyterian Medical Center, the Los Angeles hospital victimized by ransomware, ended up paying out ten times the amount demanded of Methodist Hospital to regain access to its systems. And future ransoms may be even larger if the operators of ransomware begin to do more reconnaissance on their targets before beginning to encrypt data. While part of the motivation for many corporate victims to pay up has been that malicious encryption doesn't constitute a theft of data for reporting purposes, the stakes might be raised considerably if attackers can identify the type of data they're encrypting—and who it belongs to—leading to more targeted ransomware attacks with potentially much bigger paydays.