A new version of ransomware called Locky infected Methodist Hospital in Henderson, Kentucky. The hospital put itself on an internal state of emergency after the malware took over their system.
Locky isn’t very different from other ransomware, but it’s used by criminal network Dridex, which is causing it to spread very quickly. The Locky ransomware infects a single computer spreads to connected network systems to further its reach. It also locks users out while and deletes backups, so the only recourse a victim has is to pay the ransom.
The Methodist Hospital attack began with a spoofed invoicing email that had an infected attachment file that, once opened, spread the infection from that computer to all of the hospital’s network, compromising other systems as it went. The hackers were asking for four bitcoins, which is about $1,600.
Methodist Hospital wasn’t the first hospital hit with ransomware. Hollywood Presbyterian Hospital in Los Angeles, California recent had to pay about $17,000 to get its files back after a ransomware attack. Methodist Hospital, however, decided to shut down its whole system and bring each one back online after clearing them from any signs of infection. They switched to doing every task by hand and on paper in the meantime. The hospital’s attorney said that no patient information was stolen during the cyberattack and patient care was not impacted.