The Real Costs of Ransomware in Healthcare (S1E25)

If you think ransomware only hits individuals, put on your seatbelt. Today, we have an interview with a hospital administrator who got hit by a ransomware attack and the hospital was offline for 23 days. However, this was only a partial recovery. This attack began in October of 2020 and, as of March 2021, they are not 100% recovered.

John Gaede, Director of Information Systems, SkyLakes Medical Center, is completely transparent about the sequence of the attack and the response. The interview begins with him getting a telephone call at 3AM. He relates that story like a John LeCarre novel, documenting a minute-by-minute response to the attack.

Before the attack, COVID has placed high demands on the network, there were some complaints about the system slowing down. To respond to this situation, the system was being upgraded when the attack hit. It first showed as a system slowdown, which did not present any red flags. Because of this, the system monitors did not react in the way they would if they had suspected an attack.

The numbers that reflect the impact of the response are shocking. John Gaede and his team had to bring 650 servers down to bare metal. They had to manage hundreds of applications. Each one of the hospital employees had to replace computers and passwords to enter the system. We have transitioned from an entertaining spy novel to a real horror show in the making.

Jeffery Phelan introduces his company, Rubrik, and talks about how Rubrik is used in the federal intelligence community to provide secure backup in case of attack. The standard in the intelligence community can be applied to a commercial system. The main lesson is what Rubrik calls “immutable” data. In other words, when one uses a secure backup system like the one provided by Rubrik, you can recover quicker because you are assured of safe data. You will not have to go through the pain of re-building the system from scratch.

John Gaede introduces a relatively new system in describing how the hospital got back on its feet – Manage, Detect, Response (MDR). John emphasizes the value of having the right people monitoring the network and looking for the right abnormalities to react to a threat.

Both Jeffrey and John indicate that attacks will continue in the future, one of the best remedies is to have safe and secure backups.

To view this webinar: CyberRx: Securing Healthcare Data.

Featured Speakers: