Incident: Cyberattack on MedStar Health's Computer Network Leads to Shutdown

Published Date: 2016-03-28

Postmortem Analysis
Timeline 1. The software failure incident at Universal Health Services occurred two days before the article was published on September 29, 2020 [Article 104740].
System 1. IT network systems across Universal Health Services (UHS) facilities [104740] 2. Computer network of MedStar Health [41808]
Responsible Organization 1. Cyber attackers targeted the computer network of MedStar Health, causing a virus infection and forcing the shutdown of online systems [Article 41808]. 2. Universal Health Services experienced a ransomware attack that led to the offline status of its IT network, affecting more than 250 hospitals and clinical facilities in the U.S. [Article 104740].
Impacted Organization 1. MedStar Health (Article 41808) 2. Universal Health Services (Article 104740)
Software Causes 1. Ransomware attack causing malware to infect the computer network of the hospital chain Universal Health Services, leading to a network outage and forcing reliance on pen and paper backup systems [104740]. 2. Virus attack on the computer network of MedStar Health, leading to the shutdown of its online database and email systems [41808].
Non-software Causes 1. Lack of proper employee training on how to avoid being hacked in medical facilities [41808] 2. Outdated and bulky hospital computer systems in need of upgrades or newer software [41808]
Impacts 1. The software failure incident at MedStar Health resulted in the shutdown of the online database, email systems, and records database, causing significant disruptions in hospital operations. This led to delays in appointments, surgeries, lab results, tests, and medication orders, as staff had to resort to using paper charts and records [41808]. 2. The software failure incident at Universal Health Services (UHS) caused chaos in healthcare facilities across the U.S., with treatment suspended, surgeries canceled, and doctors and nurses forced to rely on pen and paper backup systems. The outage led to longer emergency room waits, redirection of ambulances to other hospitals, and anxiety over patient care, especially for COVID-19 cases. Critical information such as lab results, imaging scans, and medication lists became inaccessible, impacting decision-making and patient care. Telemetry monitors for critical care patients also went dark, requiring restoration with ethernet cabling [104740].
Preventions 1. Proper training of employees on how to avoid being hacked, especially in healthcare institutions where employees may not be as well-versed in cybersecurity practices [41808]. 2. Upgrading outdated and bulky hospital computer systems with newer software to prevent vulnerabilities that can be exploited by cybercriminals [41808]. 3. Implementing extensive IT security protocols and working diligently with IT security partners to protect systems and data from malware attacks [104740]. 4. Conducting regular system data backups to ensure quick recovery in case of ransomware attacks without having to pay the ransom [104740].
Fixes 1. Implementing extensive IT security protocols to protect systems and data [104740]. 2. Working diligently with IT security partners to restore IT infrastructure and business operations as quickly as possible [104740]. 3. Making steady progress with recovery efforts, with certain applications already coming online and others projected to be restored on a rolling basis [104740]. 4. Using established backup processes, including offline documentation methods, to ensure patient care continues to be delivered safely and effectively [104740]. 5. Conducting diligent daily system data backups as the only effective way to recover from ransomware attacks for those unwilling to pay ransoms [104740].
References 1. Employees at Universal Health Services [104740] 2. Spokespeople from Universal Health Services [104740] 3. John Riggi, senior cybersecurity adviser to the American Hospital Association [104740] 4. UHS workers at company facilities in Texas and Washington, D.C. [104740] 5. BleepingComputer, an online cybersecurity news site [104740]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - Article 41808 reports on a software failure incident at MedStar Health due to a virus attack on its computer network. This incident led to the shutdown of the online database and email systems of the healthcare provider. The article mentions that ransomware attacks, similar to the one experienced by MedStar Health, have occurred at other medical institutions in California and Kentucky as well. The incident at MedStar Health highlights the vulnerability of healthcare organizations to cyberattacks and the potential impact on patient care and operations [41808]. (b) The software failure incident having happened again at multiple_organization: - Article 104740 discusses a computer outage at Universal Health Services (UHS) due to an apparent ransomware attack. This incident affected more than 250 hospitals and clinical facilities operated by UHS across the U.S. The article mentions that ransomware attacks targeting healthcare institutions have become increasingly common during the pandemic, with criminals demanding payment to unlock encrypted data. The incident at UHS is part of a broader trend of ransomware attacks affecting various organizations, including healthcare providers, businesses, and government entities [104740].
Phase (Design/Operation) design, operation (a) The software failure incident at Universal Health Services (UHS) was due to an apparent ransomware attack that caused the company's IT network to go offline [104740]. This incident can be attributed to contributing factors introduced during the system development or system updates, as ransomware attacks often exploit vulnerabilities in software systems to gain unauthorized access and encrypt data. (b) The software failure incident at MedStar Health was also related to a virus attack on their computer network, forcing them to shut down their online database [41808]. This incident can be linked to contributing factors introduced during the operation of the system, as the virus likely infiltrated the network through operational activities such as email communications or network usage.
Boundary (Internal/External) within_system (a) within_system: The software failure incidents reported in both Article 41808 and Article 104740 were primarily caused by factors originating from within the system. In Article 41808, the failure at MedStar Health was due to a virus infecting the computer network, leading to the shutdown of online databases and email systems [41808]. Similarly, in Article 104740, the software failure at Universal Health Services was caused by a ransomware attack that affected the IT network across UHS facilities, leading to the shutdown of networks and online systems [104740]. These incidents highlight failures originating from within the system itself, such as vulnerabilities in the network security and IT infrastructure.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - Article 41808 reports on a virus attack on the computer network of MedStar Health, leading to the shutdown of its online database. The virus infected the network, forcing the organization to take down all system interfaces to prevent further spread [41808]. - Article 104740 describes a computer outage at Universal Health Services caused by an apparent ransomware attack. The malware attack occurred early Sunday morning, leading to the shutdown of all networks across the U.S. enterprise. The company stated that patient or employee data had not been accessed, copied, or misused [104740]. (b) The software failure incident occurring due to human actions: - Article 41808 mentions that hospitals are vulnerable to ransomware attacks partly because employees are not properly trained to avoid being hacked. Additionally, outdated and bulky computer systems in hospitals contribute to the vulnerability [41808]. - Article 104740 discusses how ransomware attacks, such as the one on Universal Health Services, are financially motivated crimes where hackers target critical data and demand a ransom. The outage at UHS had characteristics of ransomware, and experts noted that criminals increasingly target health care institutions with such attacks during the pandemic [104740].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - Article 104740 reports a software failure incident at Universal Health Services due to an apparent ransomware attack, which caused the company's network to go offline. This incident was attributed to a cyberattack involving malware, indicating that the failure originated from external factors affecting the hardware infrastructure of the company [104740]. (b) The software failure incident occurring due to software: - Article 41808 describes a software failure incident at MedStar Health caused by a virus attack on the computer network. This incident led to the shutdown of the online database and email systems, indicating that the failure originated from software-related issues within the network [41808].
Objective (Malicious/Non-malicious) malicious (a) The software failure incidents reported in both Article 41808 and Article 104740 are classified as malicious. In Article 41808, a virus attacked the computer network of MedStar Health, leading to the shutdown of the online database, and the incident was investigated by the FBI. The virus demanded ransom in exchange for regaining access to the system, which is a characteristic of ransomware attacks carried out with the intent to harm the system [41808]. Similarly, in Article 104740, Universal Health Services experienced a ransomware attack that caused its network to go offline. The attack was described as a suspected ransomware attack by cybersecurity experts, and employees reported that files were being renamed with the .ryk extension used by the Ryuk ransomware. The incident led to treatment suspensions, surgeries being canceled, and chaos in healthcare facilities, indicating a malicious intent to disrupt operations and potentially harm patients [104740].
Intent (Poor/Accidental Decisions) poor_decisions From the provided articles, the software failure incidents at MedStar Health and Universal Health Services were both related to ransomware attacks. Ransomware is a type of malicious software that locks users out of their computers or networks until a ransom is paid. In both cases, the intent behind the software failure incidents can be attributed to poor decisions made by the attackers who deployed the ransomware. These attackers likely made a deliberate choice to target the healthcare institutions with ransomware in order to extort money from them. This aligns with the intent of the software failure incidents being categorized under poor_decisions. Additionally, the ransomware attacks on healthcare institutions like MedStar Health and Universal Health Services are part of a broader trend where cybercriminals increasingly target organizations with ransomware during the pandemic. This indicates a deliberate and calculated decision by the attackers to exploit vulnerabilities in the healthcare sector for financial gain, further supporting the classification of the intent behind the software failure incidents as poor_decisions. Therefore, the software failure incidents in both articles can be attributed to poor_decisions made by the cybercriminals who launched the ransomware attacks, aiming to disrupt operations and extort money from the affected healthcare organizations.
Capability (Incompetence/Accidental) unknown (a) The software failure incident at MedStar Health [41808] was not explicitly attributed to development incompetence. However, the article highlighted vulnerabilities in the healthcare sector due to inadequate employee training on cybersecurity measures and outdated computer systems. The lack of proper training on how to avoid being hacked and the outdated, bulky hospital computer systems were mentioned as factors contributing to the vulnerability of medical facilities to cyberattacks. (b) The software failure incident at Universal Health Services [104740] was attributed to an apparent ransomware attack, which is a deliberate act by cybercriminals to infect networks with malicious code that scrambles data. The attack on UHS was described as a suspected ransomware attack, with employees reporting characteristics of the ransomware known as Ryuk. The ransomware attack on UHS was intentional and not accidental, as cybercriminals demanded payment to unlock the encrypted data.
Duration temporary (a) The software failure incident reported in Article 41808 related to the virus attack on MedStar Health's computer network was temporary. The incident forced the medical network to shut down its online database, leading to delays in appointments, surgeries, lab results, and medication orders. Hospital staff had to resort to using paper charts and records, indicating a temporary disruption in operations [41808]. (b) The software failure incident reported in Article 104740 related to the ransomware attack on Universal Health Services' network was also temporary. The attack caused chaos in healthcare facilities across the U.S., with treatment suspended, surgeries canceled, and doctors and nurses relying on pen and paper backup systems. The outage lasted for at least two days, with the company working diligently to restore IT infrastructure and business operations as quickly as possible [104740].
Behaviour crash, other (a) crash: The software failure incidents reported in the articles can be categorized as crashes. In both incidents at MedStar Health and Universal Health Services, the computer networks were attacked by malware, leading to the systems being shut down and offline, causing chaos in the hospitals. This resulted in treatment being suspended, surgeries being canceled, and doctors and nurses having to resort to pen and paper backup systems [41808, 104740]. (b) omission: The software failures did not seem to be primarily due to omission, as there is no indication that the systems were omitting to perform their intended functions. Instead, the failures were more related to the systems being compromised by malware, leading to shutdowns and disruptions in services [41808, 104740]. (c) timing: The incidents did not involve failures due to timing issues where the systems were performing their intended functions but at incorrect times. The primary issue was the systems being offline or shut down due to the malware attacks, causing delays and disruptions in patient care and hospital operations [41808, 104740]. (d) value: The software failures were not related to the systems performing their intended functions incorrectly. The main issue was the systems being compromised by ransomware attacks, leading to shutdowns and disruptions in hospital operations, rather than the systems providing incorrect outputs or results [41808, 104740]. (e) byzantine: The software failures did not exhibit behaviors of a byzantine failure where the systems behave erroneously with inconsistent responses and interactions. The incidents were more straightforward in terms of the systems being attacked by ransomware, leading to shutdowns and chaos in the hospitals [41808, 104740]. (f) other: The behavior of the software failure incidents can be described as system compromise due to external cyberattacks. The malware attacks on the computer networks of MedStar Health and Universal Health Services led to the systems being taken offline, causing disruptions in patient care, surgeries, and hospital operations. The incidents highlight the vulnerability of healthcare institutions to cyber threats and the significant impact such attacks can have on critical services [41808, 104740].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence death, property, delay, non-human (a) death: People lost their lives due to the software failure - In a ransomware attack on a hospital chain, the first known fatality related to ransomware occurred in Duesseldorf, Germany, after an attack caused IT systems to fail, and a critically ill patient needing urgent admission died after she had to be taken to another city for treatment [104740]. (b) harm: People were physically harmed due to the software failure - There is no direct mention of physical harm to individuals due to the software failure incidents described in the articles. (c) basic: People's access to food or shelter was impacted because of the software failure - There is no mention of people's access to food or shelter being impacted due to the software failure incidents described in the articles. (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incidents resulted in the hospital chain Universal Health Services experiencing an apparent ransomware attack, causing its network to remain offline, surgeries to be canceled, and treatment suspended, impacting patient care and operational aspects [104740]. (e) delay: People had to postpone an activity due to the software failure - Due to the ransomware attack on the hospital chain Universal Health Services, there were delays in patient care, longer emergency room waits, and surgeries being canceled [104740]. (f) non-human: Non-human entities were impacted due to the software failure - The software failure incidents primarily impacted the computer networks and systems of the healthcare institutions, affecting their operations and patient care [41808, 104740]. (g) no_consequence: There were no real observed consequences of the software failure - There were significant consequences observed in both software failure incidents, including disruptions to patient care, surgeries being canceled, longer emergency room waits, and impacts on hospital operations [41808, 104740]. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The articles do not mention potential consequences discussed that did not occur. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - There is no other consequence mentioned beyond the impact on patient care, hospital operations, and delays in services due to the software failure incidents described in the articles.
Domain information, health (a) The failed system was intended to support the information industry as it affected the production and distribution of information in the healthcare sector. The software failure incidents at MedStar Health [41808] and Universal Health Services [104740] disrupted the online database, email systems, and network operations of the healthcare facilities, impacting the flow of information crucial for patient care and administrative functions. (j) The health industry was directly impacted by the software failure incidents at MedStar Health [41808] and Universal Health Services [104740]. These incidents disrupted hospital operations, patient care, surgeries, and access to critical information such as lab results, imaging scans, and medication lists. The failures led to chaos in healthcare facilities, affecting the delivery of healthcare services and causing delays in treatments.

Sources

Back to List