Johnson Memorial Health in Indiana was the victim of a ransomware incident in early October that was quickly reported in the press:
The hackers gained access to the hospital’s network at 10:31 p.m. Friday and installed ransomware by 10:33 p.m. The hospital’s IT team discovered the attack within about 15 minutes and immediately shut down the system, said Dr. David Dunkle, the hospital’s president and CEO.
An undated notice on JMH’s web site home page explains:
Johnson Memorial Health continues to work with our cybersecurity partners and the FBI to investigate a cyberattack that occurred on October 2. As a result of this attack, the computer network at JMH has been disabled. We are working as quickly as possible to restore normal computer operations. However, these types of attacks take time to fully resolve and it may be several days before the JMH computer system is fully operational.
At this time, no appointments or surgeries have been canceled and we ask all patients scheduled to receive services to report to JMH as normal. We do recommend patients arrive a bit earlier than usual, as registration processes may be slower than on a typical day. We thank all our patients and visitors for their patience as we continue to recover from this event.
The last update on their Twitter account was October 11, and read:
Due to the recent cyberattack, some of our physician practice phone lines are not working. We are able to retrieve voicemails, so please leave a message when prompted and we will contact you as quickly as possible.
This week, threat actors known as Hive publicly claimed responsibility for the attack by adding JMH to their dark web leak site where they dump data from victims who do not agree to pay their extortion demands.
Their listing claims:
Full patient info stolen.
150k DOB/SSN/Name+Surname
Diagnosis information
Next of kin
300GB of data from File Server stolen.
They offered no proof of claim, but their countdown clock indicated that JMH would have two days before data starts being dumped.
In the past, Hive has hit other hospitals and medical entities and has dumped data, as threatened, although they do not always dump data as quickly as they threaten. DataBreaches.net is not linking to their leak site.
Assuming JMH sticks to a decision not to pay extortion to criminals, they and their employees and patients may want to stay vigilant about their data being dumped.