Eye Opener for Hospitals
AIIMS, Delhi had announced January 1st, 2023 of becoming paperless and April, 2023 of becoming completely digital. It was a welcome step considering the efficiency digitization has over manual system. But on November 23rd, a massive cyber attack was reported by AIIMS. The massive cyber attack on AIIMS server has badly hit the patient care services which included appointments, registration, admission, discharge and report generation among other services. The Government owned National Informatics Centre (NIC) has been trying to restore the system and has expressed the possibility that this may be a ransomware attack on the AIIMS Server.
What is ransomware ? Ransomware is a type of malware program. Malware threatens to publish the victim’s personal data or permanently block access to it unless a ransom is paid. While some simple ransomware may lock the system without damaging any files, more advanced malware uses a technique called cryptoviral extortion. It encrypts the victim’s files, making them inaccessible, and demands a ransom payment to decrypt them. The attackers are also untraceable since the ransom is generally in digitally currencies such as Bitcoin or paysafecard.
Some important statistics of ransomware may astonish the medical fraternity. In 2020, 304.6 million ransomware attacks were reported worldwide while in 2021 the attack were 623.3 million and in the first half of 2022 there were 236.1 million ransomware attempts were made. The primary target of the attacks is on Windows and Mac based system but in 2022 Linux ransomware has seen an increase of 146%. Though the target of ransomware attackers had been the developed countries like USA and Europe but nowadays the developing countries are also being targeted. Another important statistic of concern is that 28% of the organisations that paid ransom was to avoid delays in recovery of data that could result in injury or death.
The above statistics should be an eye-opener for the medical fraternity in India. While digitization of the hospital system cyber-attack should be factored. Though no software can be full-proof against the attack, but efforts should be made on five factors while designing the software i.e. the application software should be prepared for such an ransomware attack; if an attack happens it should have means to prevent it; the software should be able to detect such an attack at the earliest; the software should remediate by stopping the environmental damage caused by the attack and finally the application software should have a mechanism to storing data continuously and then restoring it when a attack happens. Also, the hospitals should have a manual system in place in case all the efforts fail since restoration of data or negotiations with ransomware attackers may take time leading to unprecedent situation like in AIIMS.
(Inputs from www.antivirusguide.com / www.cloudwards.net)
Suyash S Trivedi
Cyber Expert