The Baton Rouge Clinic is continuing to make progress restoring systems that were affected by a cyberattack late last week.
As of Wednesday morning, only the radiology department was still down, according to the clinic’s executive director, Ed Silvey, who says patients needing X-rays have been referred to nearby Baton Rouge Radiology or Lake Imaging instead.
But the attack has been more than a little disruptive to the clinic, which has more than 250,000 patients throughout the Capital Region. According to a brief statement issued July 10, the clinic’s email system, phone system, as well as lab and radiology services were affected.
There was no mention that patient medical or billing records were impacted. Silvey declines to comment on any details of the attack because an active investigation is underway.
“We cannot comment while the investigation is going on and that would be the case if this were an HR matter or a professional liability matter or anything that was being actively investigated,” he says. “But our IS staff has done a wonderful job of getting us back up.”
While clinic officials decline to discuss the cyberattack, local cybersecurity experts say it should serve as a cautionary tale to other health care providers—indeed, all businesses—about their vulnerabilities, particularly amid a pandemic, when people are working remotely and the use of online platforms like telemedicine has increased exponentially.
“Malware authors are targeting groups because of COVID, offering information that could supposedly help them, and people are clicking on links,” says LSU computer science professor Golden Richard III, associate director of the university’s Center for Computation and Technology. “People are working online, communicating through emails more, and emails have links in them that are maybe not what you would have encountered in the past, like, ‘click here to meet on Zoom.’”
Though Richard has no firsthand knowledge of what happened at Baton Rouge Clinic, sources familiar with the situation say the cyberattack appears to have been a ransomware attack that came through the clinic email system.
Those are by far the most common types of malware attacks, Richard says, and have cost local and state governments as well as companies untold billions of dollars in recent years.
What’s particularly troubling about ransomware attacks is that in the past, attackers would typically encrypt a user’s data and hold it hostage until a ransom was paid. Today, increasingly, attackers also steal the data and use it for a variety of malicious purposes.
“It can be very damaging for corporations,” Richard says. “Often, the attackers will threaten divulging corporate secrets and salaries and things like that.”
While the threat is perhaps higher than ever, most companies are not prepared for an attack and are not taking the necessary backup measures, which Richard says include isolating their systems so an attack on a company’s email doesn’t infect its billing or HR systems and, more importantly, keeping offline backups, perhaps multiple copies in multiple locations.
“So many organizations have no offline backups, cold backups, that are not attached to anything, in multiple physical locations,” he says. “It requires manual labor on the part of IT. It may require hiring somebody. But in the face of literally losing your business, hiring a person to move hard drives around would seem like a no-brainer.”
While companies need to take steps to protect their data and systems, the best advice for the individual user is still the same: Don’t click on links unless you’re sure they’re legit.
“The unfortunate thing for cybersecurity experts is that people are sick of the same old advice—don’t click on things—but we don’t have a lot of advice to offer,” he says. “Antivirus software will help but malware authors are very good at evading antivirus software.”
The other challenge cybersecurity experts face in trying to communicate the very real threat to governments, businesses and individual users is fear factor overload.
“I’ve wondered why people are not more scared, and maybe they are and just have 50 other things to also be terrified about,” he says. “But this threat is real. The average user is faced with incredible risk every time they go online.”
[polldaddy poll=10580345]
