Hackers in CT hospital cyberattacks looked for ‘juicy target’
Experts are warning that a cyberattack targeting Prospect Medical Holdings and the Eastern Connecticut Health Network could lead to delays in life-saving treatment and the release of personal health and financial information.
Some services remained down at ECHN and Waterbury Health on Wednesday after the hospital systems’ parent company — California-based Prospect — was hit by a ransomware attack.
ECHN operates Manchester Memorial Hospital and Rockville General Hospital in Vernon. Waterbury Health operates Waterbury Hospital.
Vahid Behzadan, an assistant professor in computer science and data science at the University of New Haven, said that health systems being targeted is fairly frequent, and repercussions could include compromised HIPAA-protected information, such as health history records.
Health systems are commonly targeted, he said, largely because of the urgent care they provide and their strong reliance on computers, leading to the necessity of restoring their systems as quickly as possible.
John Riggi, national adviser for cybersecurity and risk for the American Hospital Association, said that health care systems being hacked has ramped up in the past decade with more reliance on computers and an increase in the digitization of health records.
He said that while that approach helped save lives during the pandemic as there were more people working and attending doctor appointments remotely, it also made systems more vulnerable to hack.
“Unfortunately, an unintended consequence of all of this integration and use of internet and network technology expanded our digital attack surface,” Riggi said, who previously worked for 28 years as an FBI agent, last serving as senior executive in the cyber division running national cyber programs.
Many foreign-based hacking groups — primarily from Russia, China, North Korea, and Iran — are exploiting vulnerabilities in the United States, he said.
While not speaking specifically about the Prospect hack, Riggi said that in similar cases, sensitive information about patients, including their health history, and…
