18 ms·

Woman dies during a ransomware attack on a German hospital

207 points by bmcn2020 6y ago

Slartie 6y ago
Important fact not stated in the article: the ransomware in question entered the hospitals' system via the Citrix vulnerability from the beginning of 2020. This has been confirmed by the German BSI (the country's institution responsible for cyber security issues). So: a gaping security hole known for eight months has been left open. This is especially important to keep in mind because their lame excuse is that they hadn't had enough time to fix the hole.
- swarnie_ 6y ago
  Are we going to pretend that all our systems, software and service are 100% up to date and there are no known issues? 8 months isn't uncommon for a lot of companies I've consulted for. In fact i've patched things with year with CVEs published in 2012/2013.
  - the8472 6y ago
    Do lives depend on those companies' infrastructure?
    - vkou 6y ago
      Indirectly, they might.
    - swarnie_ 6y ago
      Some would argue the opposite, our inf. being up probably contributes to more deaths then when its down.
      - the8472 6y ago
        Then I don't think the situation is comparable. The hospital should keep things up to date and your clients should run things into the ground.
      - apetresc 6y ago
        Well now I'm curious...
        swarnie_ 6y ago
        "Defence" manufacturing.
  - threentaway 6y ago
    In all seriousness, how does this happen? Security updates are typically just installed with an apt-get upgrade and you're looking at a few minutes of downtime if the services needs to be restarted. Containers are even easier.
    - Bombthecat 6y ago
      How? It cost money and there is a... Hmm delayed impact (or none) that's why. But : germany is bringing out a new law about important IT infrastructure where you need a soc/ siem etc. I think its called IT sig.
      - pjmlp 6y ago
        This is definitely the kind of thing we need, when there is law involved, maybe that C library isn't appealing any more, or the CI/CD with all sorts of static analysis finally get the green light for the necessary infrastructure.
    - saagarjha 6y ago
      There’s no way most hospitals are using containers and a package manager, or even Linux for that matter.
    - tstrimple 6y ago
      You mean you're just running apt-get upgrade on critical systems which are literally responsible for the life and death of people without extensive testing and roll back procedures?
  - pjmlp 6y ago
    No, but if companies start getting liable for not ensuring up to date secured software, the priorities will certainly change.
- KorfmannArno 6y ago
  The Problem seems to be that the hackers planted a backdoor in early 2020. So, the security hole was actually patched shortly after release of the security patch. Edit: Source: https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesseldorf-Shitrix-schlug-zu-4904979.html https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesse...
jdmoreira 6y ago
How much of a lowlife do you have to be to ransomware a Hospital? If these people put 1/5 of the work towards a productive software product they would probably make 10x the money.
- fefe23 6y ago
  They did not actually attack a hospital. They attacked a university which happens to have an attached hospital, and ended up on some servers used by the hospital. The ransom notice was targeted at the university. When the cops contacted them to tell them they had attacked a hospital, the ransomware people gave them the keys. The hospital has access to their data again. Looks like even criminals have a conscience. Or maybe they figured if someone dies they might be an actual effort by the police to hunt them down and put them in jail for a decade or two so they better cooperate.
- markdown 6y ago
  It was an accident. The intended target was a University next door. The ransom note was addressed to the University. The ransomers gave them the decryption keys the moment they realised what had happened.
  - eggy 6y ago
    It's not an accident. It is a supposed unintended consequence of a criminal act.
    - markdown 6y ago
      > unintended consequence Yeah, we call that an accident. Just like hitting someone with your car can be an unintended consequence of driving.
      - Caligatio 6y ago
        This is a dishonest comparison. A more appropriate analogy would be you were deliberately trying to run someone over with your car and you ended up hitting a pregnant woman as well. Then your defense is "I'm not a monster, of course I didn't purposely hit a pregnant woman."
iovrthoughtthis 6y ago
Have any other health services been under attack recently?
rscho 6y ago
In modern hospitals, inability to access the EHR will prevent you from doing _anything_! CTs, MRIs, EKGs, automated drug distributing machines, you name it... will simply refuse to work if the patient is not admitted. And no, vendors don't provide you with a "special key" to bypass that. Any problem? Call the company tech and he'll be here real soon... in 12 hours. People call for more automation but they forget the downsides in resource constrained places such as the public hospital system. This thread is full of people who don't know what they're talking about.
- NanoCoaster 6y ago
  Could you point to any resources for reading / learning about this? Even articles, blog posts? I'm not doubting you (I've worked with the manufacturing industry before, sounds eerily similar), it just seems very, uh, precarious, to say the least and I'm interested to learn more about it.
  - rscho 6y ago
    Not really, sorry. This is from personal experience, and all I have is anectodes from the trenches of the OR and ER. I guess you might find some articles on MEDLINE/Pubmed, but I suspect that it's not a well-studied problem because it doesn't make/lose enough money for the right people. However, even if emergency escape hatches exist for the particular task at hand I'd bet on the staff on site to not be aware of those anyways. Technology brought complexities to healthcare that healthcare workers are not educated to handle. For instance, try asking to undock a surgical robot for anesthesia to gain access to the patient in an emergency. On DaVinci robots, there's a procedure for doing that in 30 seconds. Last time we tried it in our OR, it took >10 minutes.
- hh2222 6y ago
  Modern hospitals have tested manual downtime processes in place.
  - rscho 6y ago
    You can ventilate or have light in manual downtime. You don't have immediate access to any advanced stuff. And that's for very specific catastrophic situations. In grey zones where things half work and emergency protocols have not been activated, the hospital is almost completely stalled.
xupybd 6y ago
That's horrible, is suspect this will only get worse as more companies pay out, more people will launch these attacks
bzb5 6y ago
> The hospital couldn’t accept emergency patients because of the attack Yes they could.
- unionpivo 6y ago
  I work at a firm that does a lot of contracting in medical field including hospitals. We are currently working with some equipment in radiology. Devices need to be connected to network, so that they can display data on proprietary viewing device connected to the network. Some devices (and viewers) are using old versions of windows (win2000 and linux, still see RH4 ) as a base. You don't have control/access over the windows machines only vendors do, and a lot of them are obsolete versions. Windos 2k is still common. Network dies (or is inaccessible) for any reason, and device is unusable, because you cant control it or see the results. I spoke to their systems guys, they are aware of risk, but their hands are often tied.
  - croon 6y ago
    That practice should be illegal. It's a form of ransomware in itself, as well as negligence in not updating it. Either have it old and offline, or connected and updated. Preferably offline and updated though. Forcing an online "subscription" and not keeping up their end of the bargain infuriates me.
    - srtjstjsj 6y ago
      They do the subscription+lockdown so that the liability is clear if the system malfunctions... hmm...
- INTPenis 6y ago
  Yeah I'm a bit skeptical to this. What exactly about a computer system prevents them from admitting a person? Just pick up a piece of paper and write down whatever you'd write down later in the computer once it's back up. It's not that hard. I could understand if a particular machine that goes ping couldn't be used because of the computer system being down. But that's a very specific issue.
Zanni 6y ago
Interesting that German authorities are considering treating the death as a homicide. The US has the felony murder doctrine where a death that occurs during the commission of a felony is automatically considered first degree murder. [0] Germany doesn't have that, but does bump up the penalties for certain specific "crimes with deadly outcome." [1] [0] https://www.law.cornell.edu/wex/felony_murder_doctrine https://www.law.cornell.edu/wex/felony_murder_doctrine [1] https://en.wikipedia.org/wiki/Murder_in_German_law#Crimes_with_deadly_outcome https://en.wikipedia.org/wiki/Murder_in_German_law#Crimes_wi...
- lionkor 6y ago
  i see why though, as it wasnt the intent to kill, but happened, like with negligence
realityking 6y ago
While tangential to the main story, I'd be interested in learning why they took the patient to a hospital in a different city. There are multiple hospitals with emergency rooms in Düsseldorf (I grew up there). Wouldn't it have been better for the patient to be taken to one of these, even if they lack the quality of care (in terms of number of different specialists on call) compared to the university hospital?
- deleted 6y ago
  [deleted]
moviuro 6y ago
I'm not surprised. I'm a security consultant in France, and hospitals are amongst the most insecure organizations we work with (along with big industrials that don't need much IT). Low/no budget, insane requirements (very high availability, low/no barrier to access records, while abiding by GDPR), obsolete machines that just work(TM). However, that "can't accept emergency patients" is surprising. I don't care if the lights are out or if I can't digitally sign their papers: hospitals should be able to run even with no machines at all. Ideas for next time: - Paper docs available (already printed) in case everything goes under (banks do that for example, for generic papers, like opening an account, etc.) - Air-gapped backup machines that can be used on the MRI/scanner/ultrasound/whatever machine (that hardware hardly ever changes, so it's not like those air-gapped machines would be a pain to manage) - Backup 4G-enabled laptop that can read the vitim's Carte Vitale (or equivalent [0]) (and which doesn't connect to the hospitals network whatsoever) - Backup hardware (Scanner, Ultrasound machine) in case someone actually fries the regular ones thanks to their horrible security (we've had plenty of such articles on HN) - Read-only machines. Once it works, unless it's for a patch, the OS and applications shoudln't be changed, at all. - User awareness training. Ransomware rarely happens by accident: someone clicked a bad document in a phishing mail. (Unless, you know, Wannacry, but that's not the norm) [0] https://en.wikipedia.org/wiki/Carte_Vitale https://en.wikipedia.org/wiki/Carte_Vitale
- gommm 6y ago
  I also don't understand this, my father died last month because of the same reason. He had an aortic dissection and in those cases time is critical (especially given that he was under anti coagulant). But they took 12 hours before they finally started treating him and claim a computer failure is the reason for that. By the time they started treating him, it was too late. I don't understand the sheer incompetence involved. He had his prescriptions with him, he was lucid enough in the first 10 hours (my mother couldn't be in the emergency with him due to covid regulation but he communicated with her by phone) to explain his medical history. They had all the elements to actually do something but they didn't because "our computer systems were not working" Hospitals should be able to run without computer systems and the budget for maintaining those same systems should be high enough to ensure things work. I can't fathom that it's not the case and I would never have expected something like this to happen. It's hard dealing both with the death of a close family member and the anger at the incompetence displayed by the French hospital system.
harha 6y ago
I'd be really interested to learn what specific systems didn't work. I recently commented on the PG&E and fires issue and I think this is significantly different regarding who is responsible - how can a hospital not operate? It's humans performing an operation, they might need data - ok that's something that should be accessible through other systems. They might need devices, is there any specific reason why they shouldn't work offline?
liability 6y ago
Sounds like murder, at least in some jurisdictions (with felony murder laws.)
- loopback_device 6y ago
  German newspapers report that it's currently classed as manslaughter (fahrlässige Tötung)
  - Jipazgqmnm 6y ago
    I would attribute this to both, - (unquestionable) the attackers but as well as - the IT-department that did not fix serious vulnerabilities (of an apparently mission critical system) We have that in all kinds of places: If you neglect your duties on maintenance or diligence in areas where humans could be harmed (electrical installations, fire safety, construction, whatsoever), you are liable for whatever happens. I don't see why IT should be somewhat special. The Citrix patch came out half a year(?) in advance.
Someone1234 6y ago
Two things can be true at the same time. In this case, that the malware authors are responsible, and that the hospital/management were negligent. Negligent circumstances seems controllable, whereas having no bad actors in the world (particularly the international world, including rogue states) seems nearly insurmountable. Every time this happens, I'm going to keep saying the same thing: Management let this happen. The dangers are known, the risk mitigation is known, and their failure to act is tantamount to negligence. This didn't "have" to happen, they allowed it to happen. But as I said at the start: Two things can be true at the same time, management's negligence let someone die and the malware authors are responsible for the death.
- nomoreusernames 6y ago
  while i wholeheartedly understand your point. i would ask you to keep in mind that not even nurses are paid what they should. IT is not getting any money before them. i dont know who does the IT stuff but ill give them the benefit of the doubt that they have their hands full? or am i naive?
  - burrows 6y ago
    How does one calculate the amount someone “should” be paid?
  - alextheparrot 6y ago
    There’s a distinction between blaming the front-line staff and the management/hospital as an entity. The likely argument is that it is the management’s role to ensure the IT department is staffed appropriately.
  - Someone1234 6y ago
    That's why I never placed blame on IT. This is a management problem, not an IT problem, front line staff do as they've told. It is management's responsibility to assess the risks and to decide where money should be spent (in this case on patient critical infrastructure). To use another poster's example: It is like them failing to upkeep their sprinkler system and part of the hospital burning down.
mullingitover 6y ago
Ransomware groups targeting hospitals should be pursued with the same zeal that governments pursue terrorists, even if lives aren't lost.
- mayniac 6y ago
  They didn't target the hospital: "The cyberattack was not intended for the hospital, according to a report from the German news outlet RTL. The ransom note was addressed to a nearby university. The attackers stopped the attack after authorities told them it had actually shut down a hospital." Source: https://www.theverge.com/2020/9/17/21443851/death-ransomware-attack-hospital-germany-cybersecurity https://www.theverge.com/2020/9/17/21443851/death-ransomware...
  - waihtis 6y ago
    Why are people making such a huge deal about who they were targeting and who not? Ransomware is digital extortion. There’s zero honor to it in any case.
    - zucker42 6y ago
      Whether they targeted the hospital might be relevant to what type of homicide they are charged with if they are caught.
    - wongarsu 6y ago
      Because if only University computers had been affected nobody would have died. If this was just some ransomware attack it would be barely newsworthy, and we sure wouldn't be discussing it. The death is what makes it interesting. And in this context it is important that the hospital wasn't even the intended target but was caught in the crossfire. That doesn't justify anything, but I think we can all agree that extortion is a less severe crime than murder.
      - waihtis 6y ago
        I get your point, but the tone in some of these is borderline defensive of ransomware. As if it would be legit otherwise, except they just misfired in this case
aschatten 6y ago
Given the proliferation of IT in everyday life, we need to change the language and remove "cyber" from cybersecurity and cyberattack. So subconsciously accepts that this is what a modern meaning is.
- oars 6y ago
  I wholeheartedly agree with this. Similar to how we don't refer to our phones as smartphones anymore. Back in the 1990s, if you had asked me to check the weather on my phone, I would've thought you meant calling up the weather channel/hotline, but now we all know exactly what you mean.
waiseristy 6y ago
Just imagine what a state-level actor is cable of doing to a countries health care / power / transportation infrastructures when damage is the goal instead of money.
- Dunedan 6y ago
  A book painting such a picture is "Black Out" by Marc Elsberg ([1], [2]). I can wholeheartedly recommend it, as it points a pretty scary, yet plausible scenario and is a proper thriller as well. Its plot takes mainly place in Germany, so it's written with a Europe-centric view and I'm not sure how well that translates to the US. However when looking at the brittle electric grid in parts of the US, I believe such attacks could be even worse there. [1]: https://en.wikipedia.org/wiki/Blackout_(Elsberg_novel) https://en.wikipedia.org/wiki/Blackout_(Elsberg_novel) [2]: https://www.amazon.com/Blackout-heart-stopping-techno-thriller-Marc-Elsberg-ebook/dp/B01MYDPTLR https://www.amazon.com/Blackout-heart-stopping-techno-thrill...)
- deleted 6y ago
  [deleted]
jkepler 6y ago
I'm not sure this is really the "first ever case of a fatality being linked to a cyberattack" as the subtitle claims. Didn't NotPetya take down a bunch of US hospital networks, as documented in the book Sandworm? I can't research the exact citation, but there were fatalities. Perhaps the difference here is there was a legal ruling.
z8rHZM8Svhu8hE2 6y ago
On the other hand, if you apply the same standards to everyone, you would have to put many politicians and hospital managers in jail for having closed many remote hospitals.
shadowgovt 6y ago
I hope they find the accountable party and bring them to justice, but also: sysadmins, consider air-gapping your critical care and patient accounting machines (at least some of them). External ransomware threats shouldn't be able to reach the machines that schedule patient care.
- 74ls00 6y ago
  The problem is that a lot of the specialist machines weren't designed with security in mind — it’s not so easy to do as you describe
  - shadowgovt 6y ago
    Neither is learning to do open-heart surgery, but both can save lives.
- srtjstjsj 6y ago
  Do you mean: hospital CEOs, fund IT to do its job, and Medicare, insist on secure facilities?
waihtis 6y ago
Everyone blaming the hospital for mismanaged IT is missing a couple things: 1) Hospitals are usually swiss cheese in terms of vulnerabilities because patient safety overrules most security issues. It’s very difficult to patch in time 2) Hospitals tend to have a tricky network and asset profile with security staff potentially inheriting decades of unmapped custom IT 3) Theyre usually underresourced and overworked
- unnouinceput 6y ago
  From January, when management became aware of this particular vulnerability, until September I'd say is more then enough time make a patch. Management can and should be liable just as the attackers. IMO there is no difference, in this case, between them two parties.
  - sitic 6y ago
    Apparently a lot of systems were backdoored in January (exploits were available before the patches), so even if the patches were installed right away the backdoor is still there [1]. The malware hackers are now slowly processing their long list of compromised systems. [1] https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/ https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019...
  - wobblykiwi 6y ago
    So I get that the vulnerability should have been patched, but to say that management and the attackers are no different is quite frankly disgusting and a very dangerous thought to have. The attackers clearly had an intent to harm, even if financially, and to lump managers in with them as if they were the ones purposefully breaking the law is unconscionable. Negligent? Yes, perhaps, we don't know the facts. But criminal? Absolutely not.
    - unnouinceput 6y ago
      Yes, it is criminal, defined by law. It's called manslaughter.
ineedasername 6y ago
Attacking systems that result in people getting killed is a great way to attract entirely more attention than I think these sorts of criminals want. At best, they might trigger the creation of laws that prohibit paying ransom to take away the incentives. At worst, they might get themselves tagged as terrorists and end up on the pointy side of a fairly urestricted use of attack drones by the US.
- shadowgovt 6y ago
  The US doesn't drone Russia; too much Cold War history there.
  - wtracy 6y ago
    More to the point: Getting people killed could make the Russian government stop turning a blind eye to cybercrime.
  - srtjstjsj 6y ago
    And too much Trump-Putin friendship
mensetmanusman 6y ago
The US healthcare system is still more fatal due to institutional problems: https://www.vox.com/2020/1/30/21113782/pregnancy-deaths-us-maternal-mortality-rate https://www.vox.com/2020/1/30/21113782/pregnancy-deaths-us-m...
aidenn0 6y ago
While there are obvious direct causes of the death here mentioned by others, I believe that everyone who has paid out a ransomware ransom has a tiny bit of blood on their hands for this one. The attackers were targeting a nearby University, the hospital was collateral damage, and they wouldn't have bothered with the attack if they didn't expect that the University would pay-out.
- srtjstjsj 6y ago
  "not negotiating with terrorists" only works if you have the support of your national security apparatus, which is otherwise engaged in starting wars for private commercial benefit.
  - aidenn0 6y ago
    Care to explain? I don't see how that follows. To me, it is clear that paying a ransom encourages the crime that the ransom repairs, regardless of anything else going on.
FpUser 6y ago
Reading more into the story - the hospital became a hostage to its own IT system. Basically they can not provide emergency services. Somehow I think it is a problem on its own. I do not have enough info but we are becoming more and more dependent on IT systems and up to what point? Are there any limits? Those systems are fragile...
- jmole 6y ago
  Thats the scary part to me. You're having a heart attack, but the computer's not working. So now we can't treat you. This is not IT anymore, this is in medical device territory. When you rely on a computer to send a medicine order to a hospital pharmacy, and you can't get drugs without it – that's a critical life support device at that point. If you can't administer medicine to a PT without scanning the barcode first, that's a critical life support device.
aaron695 6y ago
This claim will be retracted by the hospital. We need a betting market, I'd say they will back down next week. The hospital refuses to state the software, so they can't care to much. People have died from ransonware many many times before in hospitals. ie [1] But orders of magnitude more people have died from hospital's shitty IT systems. [1] https://krebsonsecurity.com/2019/11/study-ransomware-data-breaches-at-hospitals-tied-to-uptick-in-fatal-heart-attacks/ https://krebsonsecurity.com/2019/11/study-ransomware-data-br...
codedokode 6y ago
Isn't main problem that hospital relied on computers too much? Why cannot they treat patients without them? What if tomorrow, say a buggy Windows 10 update disables their systems, will someone else die?
- srtjstjsj 6y ago
  Comouters increase efficiency. The problem is under investment in healthcate and over investment in insurance company paper pushers and $800Million fraud by people like US Senator and anti-voting-rights activist former CEO Rick Scott.
afrcnc 6y ago
Maybe one of the nice-guy mods can replace the link to the actual source, the AP report, which has all the details: https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94 https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94 Verge coverage is... shallow
itoocode 6y ago
IT system failure should never affect hospitals. This is strange (worked in IT hospital systems in Europe) most of the hospitals have IT disaster / recovery plan to operate during failures like this. And hospital admissions switch to classic paper based.
- srtjstjsj 6y ago
  This is wishful thinking. A paper backup process doesn't mean that nothing will go wrong. If that were possible they wouldn't bother with computers in the first place.
nix23 6y ago
>The hospital couldn’t accept emergency patients because of the attack Why? Was the ER robot down or what exactly are the dependencies for a doctor to rely on a Computer-system?
nokya 6y ago
After reading most of the comments, I am actually quite surprised at the overall "leniency" shown to the hosital's management. In particular, considering there is absolutely no information on how the attack was actually carried out. One comment mentions that the German cybersecurity agency "confirmed" that initial access occurred through public-facing Citrix servers that were missing security patches, without any source to support the claim. Another commenter linked an article[1] indicating that the attack was "likely" carried out through Citrix servers, which seems more speculative than anything. I think that two elements are worth mentioning here. First, protecting an IT infrastructure from ransomware is not a "simple" IT task (e.g. patching a server or just doing regular backups) but requires the successful implementation and combination of a large set of technical and organizational measures/controls. Without additional details, in particular regarding how initial access[2] then lateral movement[3] were carried out by the attackers, I don't see any validity in debating whose fault this is. But that's just my opinion... Second, press coverage[4] seems quite adamant that the hospital was not targeted and that the attack was a collateral damage that resulted from the university and the hospital having their information system mutually trusting each other. If we had to consider collateral damage as a valid ground to sentence someone to life in prison (as suggested in several comments here), many governments that offer the highest level of freedom to their citizens should definitely start expanding their prisons. In many countries and regions, Europe in particular, collateral damage is not necessarily attributed to recklessness or negligence. In order to support the accusation made by many commenters here, we would need to demonstrate either of two of the following: 1. That the attackers knew in advance that compromising the university would also result in compromising the hospital. 2.That hospital/health critical information systems being directly linked to universities without adequate security is common practice AND common knowledge among cybercriminals. Except for the "five eyes" countries, the justice system in most civilized countries still recognizes the notion that an accused should not necessarily carry the total burden of the damage caused by her/his actions. In other words: although Germany may charge the author(s) for homicide by negligence, they will very likely also have a good look at whether or not the hospital's management did not commit recklessness, either by refusing care to a dying patient, or by failing to protect its critical information system or by failing to implement fallback procedures as any other critical infrastructure supposedly does today. Until then, I probably repeat myself, I don't see any validity in debating responsibilities in this specific incident, or expressing wishful thinking, until we have more information about what happened. 1: https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesseldorf-Shitrix-schlug-zu-4904979.html https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesse... 2: https://attack.mitre.org/tactics/TA0001/ https://attack.mitre.org/tactics/TA0001/ 3: https://attack.mitre.org/tactics/TA0008/ https://attack.mitre.org/tactics/TA0008/ 4: https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94 https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94
radu_floricica 6y ago
Like the article said, this is the first death that's caused by ransomware attack. However, there are plenty of deaths that can be prevented by using an RMN machine. Making RMN machines all over the world 1% more efficient by linking them up to the cloud saved many hundreds of lives so far - not having hospitals impervious to ransomware attacks cost 1 live so far, and it seemed to be by mistake. The attack ceased when they found out it was a hospital. I'd really like to hear an argument saying that we need to make all hospitals robust to ransomware attacks AND THE EQUIVALENT RISK-EVENTS, because you don't get to chose before the fact which event you need to guard against. It's very cheap to say post-fact, in the comment thread of this particular news, that management should have taken care of this and screw the cost (I'd expect HN people to be aware that competent IT services aren't dirt cheap). But do we also need to guard better against falling planes? Or storms? Or homicidal family members? Or rabid dog attacks? I'm almost tempted to put shark attacks on the list as well, because at 1 victim globally, there must have been some circumstance where a floating hospital got a patient killed by a shark.

207 points by bmcn2020 6y ago

Important fact not stated in the article: the ransomware in question entered the hospitals' system via the Citrix vulnerability from the beginning of 2020. This has been confirmed by the German BSI (the country's institution responsible for cyber security issues). So: a gaping security hole known for eight months has been left open. This is especially important to keep in mind because their lame excuse is that they hadn't had enough time to fix the hole.

swarnie_ 6y ago
Are we going to pretend that all our systems, software and service are 100% up to date and there are no known issues? 8 months isn't uncommon for a lot of companies I've consulted for. In fact i've patched things with year with CVEs published in 2012/2013.
- the8472 6y ago
  Do lives depend on those companies' infrastructure?
  - vkou 6y ago
    Indirectly, they might.
  - swarnie_ 6y ago
    Some would argue the opposite, our inf. being up probably contributes to more deaths then when its down.
    - the8472 6y ago
      Then I don't think the situation is comparable. The hospital should keep things up to date and your clients should run things into the ground.
    - apetresc 6y ago
      Well now I'm curious...
      - swarnie_ 6y ago
        "Defence" manufacturing.
- threentaway 6y ago
  In all seriousness, how does this happen? Security updates are typically just installed with an apt-get upgrade and you're looking at a few minutes of downtime if the services needs to be restarted. Containers are even easier.
  - Bombthecat 6y ago
    How? It cost money and there is a... Hmm delayed impact (or none) that's why. But : germany is bringing out a new law about important IT infrastructure where you need a soc/ siem etc. I think its called IT sig.
    - pjmlp 6y ago
      This is definitely the kind of thing we need, when there is law involved, maybe that C library isn't appealing any more, or the CI/CD with all sorts of static analysis finally get the green light for the necessary infrastructure.
  - saagarjha 6y ago
    There’s no way most hospitals are using containers and a package manager, or even Linux for that matter.
  - tstrimple 6y ago
    You mean you're just running apt-get upgrade on critical systems which are literally responsible for the life and death of people without extensive testing and roll back procedures?
- pjmlp 6y ago
  No, but if companies start getting liable for not ensuring up to date secured software, the priorities will certainly change.
KorfmannArno 6y ago
The Problem seems to be that the hackers planted a backdoor in early 2020. So, the security hole was actually patched shortly after release of the security patch. Edit: Source: https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesseldorf-Shitrix-schlug-zu-4904979.html https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesse...

jdmoreira 6y ago

How much of a lowlife do you have to be to ransomware a Hospital? If these people put 1/5 of the work towards a productive software product they would probably make 10x the money.

fefe23 6y ago
They did not actually attack a hospital. They attacked a university which happens to have an attached hospital, and ended up on some servers used by the hospital. The ransom notice was targeted at the university. When the cops contacted them to tell them they had attacked a hospital, the ransomware people gave them the keys. The hospital has access to their data again. Looks like even criminals have a conscience. Or maybe they figured if someone dies they might be an actual effort by the police to hunt them down and put them in jail for a decade or two so they better cooperate.
markdown 6y ago
It was an accident. The intended target was a University next door. The ransom note was addressed to the University. The ransomers gave them the decryption keys the moment they realised what had happened.
- eggy 6y ago
  It's not an accident. It is a supposed unintended consequence of a criminal act.
  - markdown 6y ago
    > unintended consequence Yeah, we call that an accident. Just like hitting someone with your car can be an unintended consequence of driving.
    - Caligatio 6y ago
      This is a dishonest comparison. A more appropriate analogy would be you were deliberately trying to run someone over with your car and you ended up hitting a pregnant woman as well. Then your defense is "I'm not a monster, of course I didn't purposely hit a pregnant woman."

iovrthoughtthis 6y ago

Have any other health services been under attack recently?

rscho 6y ago

In modern hospitals, inability to access the EHR will prevent you from doing _anything_! CTs, MRIs, EKGs, automated drug distributing machines, you name it... will simply refuse to work if the patient is not admitted. And no, vendors don't provide you with a "special key" to bypass that. Any problem? Call the company tech and he'll be here real soon... in 12 hours. People call for more automation but they forget the downsides in resource constrained places such as the public hospital system. This thread is full of people who don't know what they're talking about.

NanoCoaster 6y ago
Could you point to any resources for reading / learning about this? Even articles, blog posts? I'm not doubting you (I've worked with the manufacturing industry before, sounds eerily similar), it just seems very, uh, precarious, to say the least and I'm interested to learn more about it.
- rscho 6y ago
  Not really, sorry. This is from personal experience, and all I have is anectodes from the trenches of the OR and ER. I guess you might find some articles on MEDLINE/Pubmed, but I suspect that it's not a well-studied problem because it doesn't make/lose enough money for the right people. However, even if emergency escape hatches exist for the particular task at hand I'd bet on the staff on site to not be aware of those anyways. Technology brought complexities to healthcare that healthcare workers are not educated to handle. For instance, try asking to undock a surgical robot for anesthesia to gain access to the patient in an emergency. On DaVinci robots, there's a procedure for doing that in 30 seconds. Last time we tried it in our OR, it took >10 minutes.
hh2222 6y ago
Modern hospitals have tested manual downtime processes in place.
- rscho 6y ago
  You can ventilate or have light in manual downtime. You don't have immediate access to any advanced stuff. And that's for very specific catastrophic situations. In grey zones where things half work and emergency protocols have not been activated, the hospital is almost completely stalled.

xupybd 6y ago

That's horrible, is suspect this will only get worse as more companies pay out, more people will launch these attacks

bzb5 6y ago

> The hospital couldn’t accept emergency patients because of the attack Yes they could.

unionpivo 6y ago
I work at a firm that does a lot of contracting in medical field including hospitals. We are currently working with some equipment in radiology. Devices need to be connected to network, so that they can display data on proprietary viewing device connected to the network. Some devices (and viewers) are using old versions of windows (win2000 and linux, still see RH4 ) as a base. You don't have control/access over the windows machines only vendors do, and a lot of them are obsolete versions. Windos 2k is still common. Network dies (or is inaccessible) for any reason, and device is unusable, because you cant control it or see the results. I spoke to their systems guys, they are aware of risk, but their hands are often tied.
- croon 6y ago
  That practice should be illegal. It's a form of ransomware in itself, as well as negligence in not updating it. Either have it old and offline, or connected and updated. Preferably offline and updated though. Forcing an online "subscription" and not keeping up their end of the bargain infuriates me.
  - srtjstjsj 6y ago
    They do the subscription+lockdown so that the liability is clear if the system malfunctions... hmm...
INTPenis 6y ago
Yeah I'm a bit skeptical to this. What exactly about a computer system prevents them from admitting a person? Just pick up a piece of paper and write down whatever you'd write down later in the computer once it's back up. It's not that hard. I could understand if a particular machine that goes ping couldn't be used because of the computer system being down. But that's a very specific issue.

Zanni 6y ago

Interesting that German authorities are considering treating the death as a homicide. The US has the felony murder doctrine where a death that occurs during the commission of a felony is automatically considered first degree murder. [0] Germany doesn't have that, but does bump up the penalties for certain specific "crimes with deadly outcome." [1] [0] https://www.law.cornell.edu/wex/felony_murder_doctrine https://www.law.cornell.edu/wex/felony_murder_doctrine [1] https://en.wikipedia.org/wiki/Murder_in_German_law#Crimes_with_deadly_outcome https://en.wikipedia.org/wiki/Murder_in_German_law#Crimes_wi...

lionkor 6y ago
i see why though, as it wasnt the intent to kill, but happened, like with negligence

realityking 6y ago

While tangential to the main story, I'd be interested in learning why they took the patient to a hospital in a different city. There are multiple hospitals with emergency rooms in Düsseldorf (I grew up there). Wouldn't it have been better for the patient to be taken to one of these, even if they lack the quality of care (in terms of number of different specialists on call) compared to the university hospital?

deleted 6y ago
[deleted]

moviuro 6y ago

I'm not surprised. I'm a security consultant in France, and hospitals are amongst the most insecure organizations we work with (along with big industrials that don't need much IT). Low/no budget, insane requirements (very high availability, low/no barrier to access records, while abiding by GDPR), obsolete machines that just work(TM). However, that "can't accept emergency patients" is surprising. I don't care if the lights are out or if I can't digitally sign their papers: hospitals should be able to run even with no machines at all. Ideas for next time: - Paper docs available (already printed) in case everything goes under (banks do that for example, for generic papers, like opening an account, etc.) - Air-gapped backup machines that can be used on the MRI/scanner/ultrasound/whatever machine (that hardware hardly ever changes, so it's not like those air-gapped machines would be a pain to manage) - Backup 4G-enabled laptop that can read the vitim's Carte Vitale (or equivalent [0]) (and which doesn't connect to the hospitals network whatsoever) - Backup hardware (Scanner, Ultrasound machine) in case someone actually fries the regular ones thanks to their horrible security (we've had plenty of such articles on HN) - Read-only machines. Once it works, unless it's for a patch, the OS and applications shoudln't be changed, at all. - User awareness training. Ransomware rarely happens by accident: someone clicked a bad document in a phishing mail. (Unless, you know, Wannacry, but that's not the norm) [0] https://en.wikipedia.org/wiki/Carte_Vitale https://en.wikipedia.org/wiki/Carte_Vitale

gommm 6y ago
I also don't understand this, my father died last month because of the same reason. He had an aortic dissection and in those cases time is critical (especially given that he was under anti coagulant). But they took 12 hours before they finally started treating him and claim a computer failure is the reason for that. By the time they started treating him, it was too late. I don't understand the sheer incompetence involved. He had his prescriptions with him, he was lucid enough in the first 10 hours (my mother couldn't be in the emergency with him due to covid regulation but he communicated with her by phone) to explain his medical history. They had all the elements to actually do something but they didn't because "our computer systems were not working" Hospitals should be able to run without computer systems and the budget for maintaining those same systems should be high enough to ensure things work. I can't fathom that it's not the case and I would never have expected something like this to happen. It's hard dealing both with the death of a close family member and the anger at the incompetence displayed by the French hospital system.

harha 6y ago

I'd be really interested to learn what specific systems didn't work. I recently commented on the PG&E and fires issue and I think this is significantly different regarding who is responsible - how can a hospital not operate? It's humans performing an operation, they might need data - ok that's something that should be accessible through other systems. They might need devices, is there any specific reason why they shouldn't work offline?

liability 6y ago

Sounds like murder, at least in some jurisdictions (with felony murder laws.)

loopback_device 6y ago
German newspapers report that it's currently classed as manslaughter (fahrlässige Tötung)
- Jipazgqmnm 6y ago
  I would attribute this to both, - (unquestionable) the attackers but as well as - the IT-department that did not fix serious vulnerabilities (of an apparently mission critical system) We have that in all kinds of places: If you neglect your duties on maintenance or diligence in areas where humans could be harmed (electrical installations, fire safety, construction, whatsoever), you are liable for whatever happens. I don't see why IT should be somewhat special. The Citrix patch came out half a year(?) in advance.

Someone1234 6y ago

Two things can be true at the same time. In this case, that the malware authors are responsible, and that the hospital/management were negligent. Negligent circumstances seems controllable, whereas having no bad actors in the world (particularly the international world, including rogue states) seems nearly insurmountable. Every time this happens, I'm going to keep saying the same thing: Management let this happen. The dangers are known, the risk mitigation is known, and their failure to act is tantamount to negligence. This didn't "have" to happen, they allowed it to happen. But as I said at the start: Two things can be true at the same time, management's negligence let someone die and the malware authors are responsible for the death.

nomoreusernames 6y ago
while i wholeheartedly understand your point. i would ask you to keep in mind that not even nurses are paid what they should. IT is not getting any money before them. i dont know who does the IT stuff but ill give them the benefit of the doubt that they have their hands full? or am i naive?
- burrows 6y ago
  How does one calculate the amount someone “should” be paid?
- alextheparrot 6y ago
  There’s a distinction between blaming the front-line staff and the management/hospital as an entity. The likely argument is that it is the management’s role to ensure the IT department is staffed appropriately.
- Someone1234 6y ago
  That's why I never placed blame on IT. This is a management problem, not an IT problem, front line staff do as they've told. It is management's responsibility to assess the risks and to decide where money should be spent (in this case on patient critical infrastructure). To use another poster's example: It is like them failing to upkeep their sprinkler system and part of the hospital burning down.

mullingitover 6y ago

Ransomware groups targeting hospitals should be pursued with the same zeal that governments pursue terrorists, even if lives aren't lost.

mayniac 6y ago
They didn't target the hospital: "The cyberattack was not intended for the hospital, according to a report from the German news outlet RTL. The ransom note was addressed to a nearby university. The attackers stopped the attack after authorities told them it had actually shut down a hospital." Source: https://www.theverge.com/2020/9/17/21443851/death-ransomware-attack-hospital-germany-cybersecurity https://www.theverge.com/2020/9/17/21443851/death-ransomware...
- waihtis 6y ago
  Why are people making such a huge deal about who they were targeting and who not? Ransomware is digital extortion. There’s zero honor to it in any case.
  - zucker42 6y ago
    Whether they targeted the hospital might be relevant to what type of homicide they are charged with if they are caught.
  - wongarsu 6y ago
    Because if only University computers had been affected nobody would have died. If this was just some ransomware attack it would be barely newsworthy, and we sure wouldn't be discussing it. The death is what makes it interesting. And in this context it is important that the hospital wasn't even the intended target but was caught in the crossfire. That doesn't justify anything, but I think we can all agree that extortion is a less severe crime than murder.
    - waihtis 6y ago
      I get your point, but the tone in some of these is borderline defensive of ransomware. As if it would be legit otherwise, except they just misfired in this case

aschatten 6y ago

Given the proliferation of IT in everyday life, we need to change the language and remove "cyber" from cybersecurity and cyberattack. So subconsciously accepts that this is what a modern meaning is.

oars 6y ago
I wholeheartedly agree with this. Similar to how we don't refer to our phones as smartphones anymore. Back in the 1990s, if you had asked me to check the weather on my phone, I would've thought you meant calling up the weather channel/hotline, but now we all know exactly what you mean.

waiseristy 6y ago

Just imagine what a state-level actor is cable of doing to a countries health care / power / transportation infrastructures when damage is the goal instead of money.

Dunedan 6y ago
A book painting such a picture is "Black Out" by Marc Elsberg ([1], [2]). I can wholeheartedly recommend it, as it points a pretty scary, yet plausible scenario and is a proper thriller as well. Its plot takes mainly place in Germany, so it's written with a Europe-centric view and I'm not sure how well that translates to the US. However when looking at the brittle electric grid in parts of the US, I believe such attacks could be even worse there. [1]: https://en.wikipedia.org/wiki/Blackout_(Elsberg_novel) https://en.wikipedia.org/wiki/Blackout_(Elsberg_novel) [2]: https://www.amazon.com/Blackout-heart-stopping-techno-thriller-Marc-Elsberg-ebook/dp/B01MYDPTLR https://www.amazon.com/Blackout-heart-stopping-techno-thrill...)
deleted 6y ago
[deleted]

jkepler 6y ago

I'm not sure this is really the "first ever case of a fatality being linked to a cyberattack" as the subtitle claims. Didn't NotPetya take down a bunch of US hospital networks, as documented in the book Sandworm? I can't research the exact citation, but there were fatalities. Perhaps the difference here is there was a legal ruling.

z8rHZM8Svhu8hE2 6y ago

On the other hand, if you apply the same standards to everyone, you would have to put many politicians and hospital managers in jail for having closed many remote hospitals.

shadowgovt 6y ago

I hope they find the accountable party and bring them to justice, but also: sysadmins, consider air-gapping your critical care and patient accounting machines (at least some of them). External ransomware threats shouldn't be able to reach the machines that schedule patient care.

74ls00 6y ago
The problem is that a lot of the specialist machines weren't designed with security in mind — it’s not so easy to do as you describe
- shadowgovt 6y ago
  Neither is learning to do open-heart surgery, but both can save lives.
srtjstjsj 6y ago
Do you mean: hospital CEOs, fund IT to do its job, and Medicare, insist on secure facilities?

waihtis 6y ago

Everyone blaming the hospital for mismanaged IT is missing a couple things: 1) Hospitals are usually swiss cheese in terms of vulnerabilities because patient safety overrules most security issues. It’s very difficult to patch in time 2) Hospitals tend to have a tricky network and asset profile with security staff potentially inheriting decades of unmapped custom IT 3) Theyre usually underresourced and overworked

unnouinceput 6y ago
From January, when management became aware of this particular vulnerability, until September I'd say is more then enough time make a patch. Management can and should be liable just as the attackers. IMO there is no difference, in this case, between them two parties.
- sitic 6y ago
  Apparently a lot of systems were backdoored in January (exploits were available before the patches), so even if the patches were installed right away the backdoor is still there [1]. The malware hackers are now slowly processing their long list of compromised systems. [1] https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/ https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019...
- wobblykiwi 6y ago
  So I get that the vulnerability should have been patched, but to say that management and the attackers are no different is quite frankly disgusting and a very dangerous thought to have. The attackers clearly had an intent to harm, even if financially, and to lump managers in with them as if they were the ones purposefully breaking the law is unconscionable. Negligent? Yes, perhaps, we don't know the facts. But criminal? Absolutely not.
  - unnouinceput 6y ago
    Yes, it is criminal, defined by law. It's called manslaughter.

ineedasername 6y ago

Attacking systems that result in people getting killed is a great way to attract entirely more attention than I think these sorts of criminals want. At best, they might trigger the creation of laws that prohibit paying ransom to take away the incentives. At worst, they might get themselves tagged as terrorists and end up on the pointy side of a fairly urestricted use of attack drones by the US.

shadowgovt 6y ago
The US doesn't drone Russia; too much Cold War history there.
- wtracy 6y ago
  More to the point: Getting people killed could make the Russian government stop turning a blind eye to cybercrime.
- srtjstjsj 6y ago
  And too much Trump-Putin friendship

mensetmanusman 6y ago

The US healthcare system is still more fatal due to institutional problems: https://www.vox.com/2020/1/30/21113782/pregnancy-deaths-us-maternal-mortality-rate https://www.vox.com/2020/1/30/21113782/pregnancy-deaths-us-m...

aidenn0 6y ago

While there are obvious direct causes of the death here mentioned by others, I believe that everyone who has paid out a ransomware ransom has a tiny bit of blood on their hands for this one. The attackers were targeting a nearby University, the hospital was collateral damage, and they wouldn't have bothered with the attack if they didn't expect that the University would pay-out.

srtjstjsj 6y ago
"not negotiating with terrorists" only works if you have the support of your national security apparatus, which is otherwise engaged in starting wars for private commercial benefit.
- aidenn0 6y ago
  Care to explain? I don't see how that follows. To me, it is clear that paying a ransom encourages the crime that the ransom repairs, regardless of anything else going on.

FpUser 6y ago

Reading more into the story - the hospital became a hostage to its own IT system. Basically they can not provide emergency services. Somehow I think it is a problem on its own. I do not have enough info but we are becoming more and more dependent on IT systems and up to what point? Are there any limits? Those systems are fragile...

jmole 6y ago
Thats the scary part to me. You're having a heart attack, but the computer's not working. So now we can't treat you. This is not IT anymore, this is in medical device territory. When you rely on a computer to send a medicine order to a hospital pharmacy, and you can't get drugs without it – that's a critical life support device at that point. If you can't administer medicine to a PT without scanning the barcode first, that's a critical life support device.

aaron695 6y ago

This claim will be retracted by the hospital. We need a betting market, I'd say they will back down next week. The hospital refuses to state the software, so they can't care to much. People have died from ransonware many many times before in hospitals. ie [1] But orders of magnitude more people have died from hospital's shitty IT systems. [1] https://krebsonsecurity.com/2019/11/study-ransomware-data-breaches-at-hospitals-tied-to-uptick-in-fatal-heart-attacks/ https://krebsonsecurity.com/2019/11/study-ransomware-data-br...

codedokode 6y ago

Isn't main problem that hospital relied on computers too much? Why cannot they treat patients without them? What if tomorrow, say a buggy Windows 10 update disables their systems, will someone else die?

srtjstjsj 6y ago
Comouters increase efficiency. The problem is under investment in healthcate and over investment in insurance company paper pushers and $800Million fraud by people like US Senator and anti-voting-rights activist former CEO Rick Scott.

afrcnc 6y ago

Maybe one of the nice-guy mods can replace the link to the actual source, the AP report, which has all the details: https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94 https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94 Verge coverage is... shallow

itoocode 6y ago

IT system failure should never affect hospitals. This is strange (worked in IT hospital systems in Europe) most of the hospitals have IT disaster / recovery plan to operate during failures like this. And hospital admissions switch to classic paper based.

srtjstjsj 6y ago
This is wishful thinking. A paper backup process doesn't mean that nothing will go wrong. If that were possible they wouldn't bother with computers in the first place.

nix23 6y ago

>The hospital couldn’t accept emergency patients because of the attack Why? Was the ER robot down or what exactly are the dependencies for a doctor to rely on a Computer-system?

nokya 6y ago

After reading most of the comments, I am actually quite surprised at the overall "leniency" shown to the hosital's management. In particular, considering there is absolutely no information on how the attack was actually carried out. One comment mentions that the German cybersecurity agency "confirmed" that initial access occurred through public-facing Citrix servers that were missing security patches, without any source to support the claim. Another commenter linked an article[1] indicating that the attack was "likely" carried out through Citrix servers, which seems more speculative than anything. I think that two elements are worth mentioning here. First, protecting an IT infrastructure from ransomware is not a "simple" IT task (e.g. patching a server or just doing regular backups) but requires the successful implementation and combination of a large set of technical and organizational measures/controls. Without additional details, in particular regarding how initial access[2] then lateral movement[3] were carried out by the attackers, I don't see any validity in debating whose fault this is. But that's just my opinion... Second, press coverage[4] seems quite adamant that the hospital was not targeted and that the attack was a collateral damage that resulted from the university and the hospital having their information system mutually trusting each other. If we had to consider collateral damage as a valid ground to sentence someone to life in prison (as suggested in several comments here), many governments that offer the highest level of freedom to their citizens should definitely start expanding their prisons. In many countries and regions, Europe in particular, collateral damage is not necessarily attributed to recklessness or negligence. In order to support the accusation made by many commenters here, we would need to demonstrate either of two of the following: 1. That the attackers knew in advance that compromising the university would also result in compromising the hospital. 2.That hospital/health critical information systems being directly linked to universities without adequate security is common practice AND common knowledge among cybercriminals. Except for the "five eyes" countries, the justice system in most civilized countries still recognizes the notion that an accused should not necessarily carry the total burden of the damage caused by her/his actions. In other words: although Germany may charge the author(s) for homicide by negligence, they will very likely also have a good look at whether or not the hospital's management did not commit recklessness, either by refusing care to a dying patient, or by failing to protect its critical information system or by failing to implement fallback procedures as any other critical infrastructure supposedly does today. Until then, I probably repeat myself, I don't see any validity in debating responsibilities in this specific incident, or expressing wishful thinking, until we have more information about what happened. 1: https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesseldorf-Shitrix-schlug-zu-4904979.html https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesse... 2: https://attack.mitre.org/tactics/TA0001/ https://attack.mitre.org/tactics/TA0001/ 3: https://attack.mitre.org/tactics/TA0008/ https://attack.mitre.org/tactics/TA0008/ 4: https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94 https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94

radu_floricica 6y ago

Like the article said, this is the first death that's caused by ransomware attack. However, there are plenty of deaths that can be prevented by using an RMN machine. Making RMN machines all over the world 1% more efficient by linking them up to the cloud saved many hundreds of lives so far - not having hospitals impervious to ransomware attacks cost 1 live so far, and it seemed to be by mistake. The attack ceased when they found out it was a hospital. I'd really like to hear an argument saying that we need to make all hospitals robust to ransomware attacks AND THE EQUIVALENT RISK-EVENTS, because you don't get to chose before the fact which event you need to guard against. It's very cheap to say post-fact, in the comment thread of this particular news, that management should have taken care of this and screw the cost (I'd expect HN people to be aware that competent IT services aren't dirt cheap). But do we also need to guard better against falling planes? Or storms? Or homicidal family members? Or rabid dog attacks? I'm almost tempted to put shark attacks on the list as well, because at 1 victim globally, there must have been some circumstance where a floating hospital got a patient killed by a shark.