Cyberattack felt around the world
Hackers used data stolen from U.S. government to attack hospitals, offices
LONDON— Hackers exploiting data stolen from the U.S. government conducted extensive cyberattacks on Friday that hit dozens of countries around the world, severely disrupting Britain’s public health system and wreaking havoc on tens of thousands of computers elsewhere, including Russia’s Ministry for Internal Security.
Hospitals in Britain appeared to be the most severely affected by the attacks, which aimed to blackmail computer users by seizing their data. The attacks blocked doctors’ access to patient files and forced emergency rooms to divert people seeking urgent care.
Corporate computer systems in many other countries — including FedEx of the United States, one of the world’s leading international shippers — were among those affected. Kaspersky Lab, a Russian cybersecurity firm, said it had recorded at least 45,000 attacks in as many as 74 countries.
It was not immediately clear who was behind the attacks, but the acts deeply alarmed cybersecurity experts and underscored the enormous vulnerabilities to Internet invasions faced by disjointed networks of computer systems around the world.
“When people ask what keeps you up at night, it’s this,” said Chris Camacho, chief strategy officer at Flashpoint, a New York security firm tracking the attacks.
Russia’s powerful Interior Ministry, after denying reports that its computers had been targeted, confirmed in a statement that “around 1,000 computers were infected,” which it described as less than 1 per cent of the total. The ministry, which oversees Russia’s police forces, said technicians had stopped the attack and were updating the department’s “anti-virus defence systems.”
The attacks were reminiscent of the hack that took down dozens of websites last October, including Twitter, Spotify and PayPal, that exploited devices connected to the Internet, including printers and baby monitors.
The hacking tool used Friday was ransomware, a kind of malware that encrypts data, locks out the user and demands a ransom to release it. Security experts say the tool exploited a vulnerability in Microsoft systems that was discovered and developed by the National Security Agency of the United States. The ransomware, known as WannaCry, was leaked by a group calling itself the Shadow Brokers, which has been dumping stolen NSA hacking tools online since last year. Microsoft rolled out a patch for the vulnerability in March, but hackers apparently took advantage of the fact that vulnerable targets — particularly hospitals — had yet to update their systems or had ignored advisories from Microsoft to do so.
The malware was circulated by email. Targets were sent an encrypted, compressed file that, once loaded, allowed the ransomware to infiltrate its targets.
Reuters reported that employees of Britain’s National Health Service had been warned about the ransomware threat earlier Friday.
But by then it was already too late. As the disruptions rippled through at least 36 hospitals, doctors’ offices and ambulance companies across Britain on Friday, the health service declared the attack a “major incident,” a warning that local health services could be overwhelmed.
Britain’s health secretary, Jeremy Hunt, was briefed by cybersecurity experts, while Prime Minister Theresa May’s office said she was monitoring the situation.
May said later on television that “we’re not aware of any evidence that patient data has been compromised.”
Among the many other affected institutions were hospitals and telecommunications companies across Europe and Asia, according to MalwareHunterTeam, a security firm that tracks ransomware attacks.
But the extent of the ransomware attacks could be much broader, as the MalwareHunterTeam said it tracks only attacks that have been reported by the victims. Spain’s Telefonica and Russia’s MegaFon were among the largest of the businesses targeted.
Other countries where attacks were reported included Japan, the Philippines, Turkey and Vietnam.
The computers all appeared to be hit with the same ransomware and similar messages demanding about $300 (U.S.) to unlock their data.
Camacho noted that security detection technology could not easily catch the ransomware attacks, because the attackers encrypted the malicious file in email attachments. When employees at victim organizations clicked on the attachments, they inadvertently downloaded the ransomware onto their systems.
Security experts advised companies to immediately update their systems with the Microsoft patch.
Until organizations use the Microsoft patch, Camacho said, they could continue to be hit — not just by ransomware, but by all kinds of malicious tools that can manipulate, steal or delete their data.
“There is going to be a lot more of these attacks,” he said. “We’ll see copycats, and not just for ransomware, but other attacks.”
The attack on Britain’s NHS appeared to be the most brazen because it had life-or-death implications for hospitals and ambulance services.
Tom Donnelly, a spokesperson for NHS Digital, the arm of the health service that handles cybersecurity, said in a telephone interview that 16 organizations, including “hospitals and other kinds of clinician services,” had been hit. Officials later updated that number to at least 25.
Less was known about the scope of the attacks in Spain and Portugal, which affected companies such as Telefonica.
Spain’s national cryptology centre said it was dealing with “a massive ransomware attack” affecting Windows systems used by various organizations, without naming them.
Later on Friday, Portugal reported a similar attack. Carlos Cabreiro, director of a police unit that fights cybercrime, told the newspaper Publico that the country was facing “computer attacks on a large scale against different Portuguese companies, especially communication operators.”
Spain’s Industry Ministry said in a separate statement that the attack had not affected networks or customers using services offered by the companies targeted. Telefonica also indicated that the attack had targeted its internal network rather than its millions of customers. On Twitter, Chema Alonso, Telefonica’s chief data officer, called initial news reports “exaggerated.”