{"id":18859,"date":"2022-04-26T05:10:21","date_gmt":"2022-04-26T13:10:21","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/04\/26\/news-12592\/"},"modified":"2022-04-26T05:10:21","modified_gmt":"2022-04-26T13:10:21","slug":"news-12592","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/04\/26\/news-12592\/","title":{"rendered":"Hospitals taken offline after cyberattack"},"content":{"rendered":"<p><strong>Credit to Author: Pieter Arntz| Date: Tue, 26 Apr 2022 13:02:58 +0000<\/strong><\/p>\n<p>The GHT Coeur Grand Est has become a victim of a cyberattack on the hospital centers of Vitry-le-Fran\u00e7ois and Saint-Dizier. The hospital\u2019s administration has <a href=\"https:\/\/ght-coeurgrandest.fr\/actualites\/informations-cyberattaque\/\" rel=\"nofollow\">warned<\/a> [French] that data have been exfiltrated and might be used for phishing in the future.<\/p>\n<p>As a consequence, the GHT C\u0153ur Grand Est has cut all incoming and outgoing internet connections from its franchises in order to protect and secure information systems and data.<\/p>\n<h2>GHT Coeur Grand Est<\/h2>\n<p>The GHT (Groupements Hospitaliers de Territoire) Coeur Grand Est is a group of nine hospitals in the Northeast of France (around Bar-le-Duc). Together they employ some 6,000 healthcare professionals and serve around 300,000 inhabitants of the region. Most of the hospitals within the GHT network operate their own IT infrastructure, but they do share certain resources. The stolen data come from the hospital centers of Vitry-le-Fran\u00e7ois (Marne) and Saint-Dizier (Haute-Marne).<\/p>\n<h2>The attack<\/h2>\n<p>On April 19, staff discovered a network breach in the systems of the GHT. During that breach, the attackers managed to copy essential administrative data. As a result, the GHT decided to cut all incoming and outgoing internet connections until the situation was resolved.<\/p>\n<p>The applications and software used internally on a daily basis were not affected by the attack and remain operational, but certain services like making online appointments aren&#8217;t possible at the moment. The computerized patient file system is fully functional.<\/p>\n<p>The hospitals said the IT team is working to assess and identify the damage and, as quickly as possible, re-establish secure links with the outside world. The information flows that come from outside, mainly lab results, are handled in old-fashioned paper format or, as was done years ago, by fax.<\/p>\n<h2>Vigilance<\/h2>\n<p>The GHT has warned customers to be vigilant, saying there is no guarantee that the exfiltrated files will not be shared and used by malicious people.<\/p>\n<p>GHT customers should stay on the lookout for targeted <a href=\"https:\/\/www.malwarebytes.com\/phishing\">phishing<\/a> attempts and scams that may look more trustworthy because the scammers have information you wouldn\u2019t expect them to have.<\/p>\n<ul>\n<li>Pay attention to the sender of messages, even if they appear to be an official sender.<\/li>\n<li>Be careful with attachments. Don\u2019t open them until you verified the origin.<\/li>\n<li>Never respond to a request for confidential information, in particular banking information.<\/li>\n<li>Pay attention to the content and wording of the message received. Phishing attempts often introduce some kind of urgency by scaring the receiver or putting time pressure behind the response.<\/li>\n<li>Be wary of phone calls or texts from unknown numbers.<\/li>\n<\/ul>\n<h2>Stolen data for sale<\/h2>\n<p>While the hospital center\u2019s announcement doesn\u2019t contain any attribution clues, <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/french-hospital-group-disconnects-internet-after-hackers-steal-data\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Bleeping Computer<\/a> spotted a new entry on Industrial Spy\u2019s website, a new marketplace for stolen data.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"55972\" data-permalink=\"https:\/\/blog.malwarebytes.com\/reports\/2022\/04\/hospitals-taken-offline-after-cyberattack\/attachment\/industrialspy\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/04\/IndustrialSpy.png\" data-orig-size=\"1317,137\" data-comments-opened=\"0\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"IndustrialSpy\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/04\/IndustrialSpy-300x31.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/04\/IndustrialSpy-600x62.png\" width=\"600\" height=\"62\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/04\/IndustrialSpy-600x62.png\" alt=\"listing on Industrial Spy platform\" class=\"wp-image-55972\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/04\/IndustrialSpy-600x62.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/04\/IndustrialSpy-300x31.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/04\/IndustrialSpy.png 1317w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><figcaption><em>image courtesy of Bleeping Computer<\/em><\/figcaption><\/figure>\n<\/div>\n<p>Industrial Spy is a dark web platform that promotes itself as a marketplace for buying corporate data that contain sensitive information like schematics, financial reports, trade secrets, and client databases.<\/p>\n<p>In this case, however, Industrial Spy isn\u2019t offering anything that could draw the attention of a competitor. Instead, the data set exposes patient data among other administrative documents. The threat actors claim that the stolen personal data of patients includes social security numbers, passport scans, banking information, email addresses, and phone numbers.<\/p>\n<p>Stay safe, everyone!<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/reports\/2022\/04\/hospitals-taken-offline-after-cyberattack\/\">Hospitals taken offline after cyberattack<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/reports\/2022\/04\/hospitals-taken-offline-after-cyberattack\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Pieter Arntz| Date: Tue, 26 Apr 2022 13:02:58 +0000<\/strong><\/p>\n<p>A group of French hospitals was taken offline afetr a data breach has been discovered. The stolen data are patient records including SSN, banking information, email addresses, and phone numbers.<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/reports\/2022\/04\/hospitals-taken-offline-after-cyberattack\/\">Hospitals taken offline after cyberattack<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[174,11172,25820,2640,1804],"class_list":["post-18859","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-cyberattack","tag-data-breach","tag-ght-coeur-grand","tag-hospital","tag-reports"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/18859","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=18859"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/18859\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=18859"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=18859"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=18859"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}