Incident: Iranian Government-Backed Hackers Target Boston Children's Hospital Network

Published Date: 2022-06-01

Postmortem Analysis
Timeline 1. The software failure incident at Boston Children's Hospital happened in June 2021 [128447].
System 1. Fortinet software made by California-based firm - exploited by the attackers to control the Boston Children’s Hospital computer network [128447]
Responsible Organization 1. Iranian government-backed hackers [128447]
Impacted Organization 1. Boston Children’s Hospital [128447]
Software Causes 1. The software cause of the failure incident was the exploitation of popular software made by California-based firm Fortinet by Iranian government-backed hackers to control the Boston Children’s Hospital computer network [128447].
Non-software Causes 1. The attempted hack of the Boston Children’s Hospital computer network was caused by Iranian government-backed hackers [128447]. 2. The hackers exploited popular software made by California-based firm Fortinet to control the hospital’s computer network [128447]. 3. The FBI received a tip about the Iranian hackers from a valued partner within the intelligence community [128447]. 4. The FBI and the Boston Children’s Hospital staff worked closely together to proactively thwart the threat to the network [128447]. 5. The incident was part of a larger trend of ransomware and hacking threats targeting the health care system, which have worsened during the coronavirus pandemic [128447].
Impacts 1. The attempted hack of the Boston Children’s Hospital computer network by Iranian government-backed hackers in June 2021 [128447] had the potential to cause significant damage to the hospital's computer network. 2. The attackers exploited popular software made by California-based firm Fortinet to control the hospital’s computer network, highlighting a vulnerability in the software [128447]. 3. The incident led to a public warning from the FBI and other agencies about Iranian government-backed hackers targeting a range of organizations across the transportation and health care sectors [128447]. 4. The FBI's proactive measures helped thwart the threat to the Boston Children’s Hospital network, preventing the deployment of ransomware and mitigating other potential associated threats [128447]. 5. The incident underscored the ongoing cybersecurity threats faced by the health care system, with ransomware and hacking incidents on the rise, particularly during the coronavirus pandemic [128447].
Preventions 1. Implementing robust cybersecurity measures such as regular security audits, penetration testing, and network monitoring to detect and prevent unauthorized access attempts [128447]. 2. Keeping software systems up to date with the latest security patches and updates to address known vulnerabilities [128447]. 3. Providing cybersecurity training and awareness programs for employees to recognize and report suspicious activities, such as phishing attempts or social engineering tactics [128447]. 4. Collaborating with intelligence communities and law enforcement agencies to share threat intelligence and receive timely alerts about potential cyber threats [128447].
Fixes 1. Enhancing cybersecurity measures and protocols within the Boston Children's Hospital computer network to prevent future hacking attempts [128447]. 2. Conducting regular security audits and vulnerability assessments on the hospital's software systems to identify and address potential weaknesses [128447]. 3. Implementing multi-factor authentication and access controls to restrict unauthorized access to critical systems and data [128447]. 4. Providing cybersecurity training and awareness programs for staff members to recognize and respond to potential security threats effectively [128447]. 5. Collaborating with intelligence agencies and cybersecurity experts to stay informed about emerging threats and best practices for cybersecurity defense [128447].
References 1. FBI Director Christopher Wray [Article 128447] 2. Joseph Bonavolonta, special agent in charge of the FBI’s Boston Field Office [Article 128447] 3. Kristen Dattoli, spokesperson for Boston Children’s Hospital [Article 128447] 4. Shahrokh Nazemi, spokesperson for Iran’s Permanent Mission to the United Nations [Article 128447]

Software Taxonomy of Faults

Category Option Rationale
Recurring multiple_organization (a) The software failure incident having happened again at one_organization: The article does not mention any previous or subsequent similar incidents happening again at the Boston Children's Hospital or with its products and services. Therefore, it is unknown if a similar incident has occurred again at the same organization [128447]. (b) The software failure incident having happened again at multiple_organization: The article mentions that the FBI and other agencies issued a public warning in November about Iranian government-backed hackers targeting a range of organizations across the transportation and health care sectors, including the Boston Children's Hospital incident. This indicates that similar incidents have happened at multiple organizations within these sectors [128447].
Phase (Design/Operation) design, operation (a) The software failure incident at Boston Children's Hospital was attributed to Iranian government-backed hackers exploiting popular software made by California-based firm Fortinet to control the hospital's computer network. This indicates a failure due to contributing factors introduced by the system development or updates [128447]. (b) The operation of the hospital's computer network was targeted by the hackers, but the FBI was able to thwart the attack before any damage was done. This incident highlights a failure due to contributing factors introduced by the operation of the system [128447].
Boundary (Internal/External) outside_system (a) within_system: The software failure incident at the Boston Children's Hospital was a result of Iranian government-backed hackers exploiting popular software made by California-based firm Fortinet to control the hospital's computer network [128447]. The hackers attempted to hack the hospital's computer network, but the FBI was able to thwart the attack before any damage was done. This incident highlights the vulnerability of the hospital's internal systems to cyberattacks originating from outside sources.
Nature (Human/Non-human) human_actions (a) The software failure incident at the Boston Children's Hospital was attributed to Iranian government-backed hackers who attempted to hack the hospital's computer network using popular software made by Fortinet [128447]. (b) The FBI was able to thwart the hackers before they could cause damage to the hospital's network, indicating human intervention to prevent the attack [128447].
Dimension (Hardware/Software) software (a) The software failure incident at the Boston Children's Hospital was attributed to Iranian government-backed hackers exploiting popular software made by the California-based firm Fortinet to control the hospital's computer network [128447]. (b) The software failure incident was a result of the attackers exploiting software made by Fortinet to gain control over the hospital's computer network. This indicates a failure originating in the software used by the hospital [128447].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident at the Boston Children's Hospital was malicious in nature, as it was an attempted hack by Iranian government-backed hackers to control the hospital's computer network. The hackers exploited popular software made by Fortinet to carry out the attack, with the FBI thwarting the activity before any damage was done [128447]. (b) There is no information in the articles suggesting that the software failure incident was non-malicious.
Intent (Poor/Accidental Decisions) unknown The software failure incident at the Boston Children's Hospital, where Iranian government-backed hackers attempted to hack the hospital's computer network, was not due to poor decisions or accidental decisions. Instead, it was a deliberate and malicious act by the hackers to exploit software vulnerabilities for their own gain [128447].
Capability (Incompetence/Accidental) accidental (a) The software failure incident at the Boston Children's Hospital was not due to development incompetence but rather a targeted cyberattack by Iranian government-backed hackers who exploited popular software made by Fortinet to control the hospital's computer network [128447]. (b) The software failure incident was accidental in the sense that the hackers were able to exploit vulnerabilities in the hospital's network using software from Fortinet, which was not intentionally designed to be exploited in such a manner. The attack was not a result of accidental system failures but rather a deliberate and malicious act by the hackers [128447].
Duration temporary (a) The software failure incident reported in the articles is more likely to be temporary rather than permanent. This is because the incident involved an attempted hack by Iranian government-backed hackers on the Boston Children’s Hospital computer network, which was thwarted by the FBI before any damage was done [128447]. The fact that the FBI was able to prevent the hackers from causing harm to the hospital's network indicates that the failure was temporary and did not result in lasting damage or consequences.
Behaviour unknown (a) crash: The software failure incident in the article does not involve a crash where the system loses state and does not perform any of its intended functions. The incident is related to an attempted hack of the Boston Children’s Hospital computer network by Iranian government-backed hackers, which was thwarted by the FBI before any damage was done [128447].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence no_consequence, theoretical_consequence (a) death: People lost their lives due to the software failure - No information in the provided article suggests that people lost their lives due to the software failure incident at the Boston Children's Hospital [128447]. (b) harm: People were physically harmed due to the software failure - There is no mention of people being physically harmed as a direct result of the software failure incident at the Boston Children's Hospital [128447]. (c) basic: People's access to food or shelter was impacted because of the software failure - The software failure incident at the Boston Children's Hospital did not impact people's access to food or shelter [128447]. (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incident at the Boston Children's Hospital did not result in any impact on people's material goods, money, or data [128447]. (e) delay: People had to postpone an activity due to the software failure - The article does not mention any activities being postponed by people due to the software failure incident at the Boston Children's Hospital [128447]. (f) non-human: Non-human entities were impacted due to the software failure - The software failure incident at the Boston Children's Hospital primarily involved the hospital's computer network being targeted by Iranian government-backed hackers, with no specific mention of non-human entities being impacted [128447]. (g) no_consequence: There were no real observed consequences of the software failure - The software failure incident at the Boston Children's Hospital was averted by the FBI before any significant damage occurred, and there were no reported consequences resulting from the incident [128447]. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The article discusses the potential high-impact hacking threats faced by the US from various governments, including Iran, Russia, China, and North Korea. While the hackers attempted to exploit the hospital's computer network, the FBI was able to thwart the attack before any significant damage was done, indicating potential consequences that did not materialize [128447]. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - There are no other consequences of the software failure incident mentioned in the article [128447].
Domain health (a) The failed system was intended to support the health industry, specifically the Boston Children's Hospital computer network [128447]. (j) The failed system was related to the health industry, as it targeted the Boston Children's Hospital computer network [128447].

Sources

Back to List