Health Management Concepts (HMC) of New Hampshire recently suffered a ransomware attack.\u00a0 The variant has not been disclosed to the public, but HMC officials did report they paid an undisclosed ransom amount.<\/p>\n
Before going on, it should be noted that paying the ransom demands is a terrible idea.\u00a0 First, there are no guarantees the hackers will provide a decryption key.\u00a0 Second, it sets the precedence\u00a0that ransom demands will be paid, making the organization a target for future attacks.<\/p>\n
Now, to be fair, in this particular instance, a decryption key was provided that unlocked all of the locked files.\u00a0 However, there is speculation that paying the hackers could have led\u00a0HMC to inadvertently providing confidential patient data to the hackers.\u00a0 But how?<\/p>\n
CoveWare, a ransomware recovery firm, suggested<\/a> to Health IT Security, that an encrypted file may have been sent to the attackers to demonstrate that they indeed could decrypt the file if the ransom was paid.\u00a0 Again, that is just speculation.<\/p>\n Regardless, the hackers got their hands on patient names, social security numbers, and insurance plan data.\u00a0 Therefore, this means a double payday for the hackers.\u00a0 Not only did they\u00a0obtain the information they can sell on the dark web, they were paid to\u00a0provide a decryption tool for files they themselves infected.<\/p>\n HMC said in a letter<\/a> to the New Hampshire Attorney General,<\/p>\n \u201cTo help prevent this type of incident from occurring again, HMC is adding enhanced security protocols to its current server, including removing access to the server through Remote Desktop Protocol. It also is migrating its server to another cloud computing service, which will provide additional security.”<\/p><\/blockquote>\n For a list of ransomware attacks that have already taken place in 2018, you may click here<\/a>. We have also created a map, see below, of the ransomware attacks that have taken place in the U.S.Other Ransomware Attacks<\/h3>\n
\n