Hospital Cybercriminals Release Stolen Data
Cybercrime gang Qilin released about 400GB of personal information stolen from Synnovis earlier this month in a cyber extortion scheme.
- Synnovis failed to pay the ransom, so Qilin exposed the data to the dark web.
- Both Synnovis and the National Health Service are working on remedying the situation.
Qilin, a cybercrime gang, has published the data stolen from several London hospitals, making people wonder why such institutions are still vulnerable to cyber extortion.
Since the turn of the millennium, technological advancements have seen exponential growth. In 2000, less than 7% of the world population was online. Today, over half of the world has Internet access.
Unfortunately, as technology grew, so did cyber-attacks and malicious activity in sophistication, often targeting companies, organizations, and institutions that store valuable data for cyber extortion. The cybercriminals would demand a ransom in exchange for not publishing the stolen assets.
In the last couple of years, as technology has revolutionized the healthcare sector, cybercriminals, like Qilin, have taken a special interest in hospitals, clinics, and other entities in charge of keeping health-related data safe.
Unpaid Ransom
On June 3rd, National Health Service (NHS) provider Synnovis became a victim of cyber extortion. The provider decided not to pay the ransom. So, Qilin, true to its word, then released about 400GB of personal information out of the claimed 1 terabyte onto the dark web, including names, birth dates, NHS numbers, and descriptions of blood tests. Whether the group added the results of the tests to the data bundle has yet to be confirmed.
Beyond the cyber extortion, the attack affected pathology services in over 1,000 hospitals and general practitioner (GP) appointments and operations. It’s one of the biggest data breaches of 2024 that the U.K. has witnessed. Both Synnovis and the NHS acknowledged people’s concerns but assured the public that they are working toward rectifying the situation.
More Efforts
Qilin claimed that they used a Zero-Day Attack to infiltrate Synnovis systems. With how fast technology is developing and how sophisticated cybercrime has become, healthcare providers should not have such vulnerable systems. They are the keepers of patients’ personal data and should be extremely mindful of falling victim to cyber blackmail. Certain governments have established cybersecurity standards that healthcare providers must abide by, but some parts of the world, that is not the case.
Governments worldwide should ensure that both public and private entities understand and apply the best cybersecurity practices possible. In the U.S., for example, the Department of Justice (DoJ) has published the Cybersecurity Maturity Model Certification (CMMC). It’s a unified standard for cybersecurity across the defense industrial base, called.
Collaboration should also be encouraged. In the U.S., the Health Sector Coordinating Council (HSCC) Cybersecurity Working Group, in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS), is delivering tools, resources, training, and information. This initiative helps organizations improve their cybersecurity.
Final Thoughts
Companies, especially hospitals and clinics, are often victims of cyber extortion schemes. To the cybercriminals, they are gold mines, keeping millions of people’s information safe from prying eyes. However, governments should enforce proper cybersecurity practices and check for compliance with the set cybersecurity laws and standards.
Inside Telecom provides you with an extensive list of content covering all aspects of the tech industry. Keep an eye on our Cybersecurity sections to stay informed and up-to-date with our daily articles.