Inquiry finds patient data safe after hospital cyberattack
Hong Kong health authorities have told a private hospital it had four weeks to submit a detailed report after it was hit by a malicious cyberattack and refused to pay a US$10 million ransom.
The Department of Health yesterday said it was investigating the incident at Union Hospital in Tai Wai, with initial findings showing the ransomware attack had not compromised any patient data or medical services.
“Our initial understanding is it did not involve [the release of] patients’ data nor did it affect the service security of the hospital,” it said. “The Department of Health has requested the hospital to hand in a detailed report in four weeks.”
Health authorities said they had also notified law enforcement agencies, including police and the city’s privacy commissioner.
Union Hospital revealed on Thursday that it had fallen prey to the ransomware attack on Monday, resulting in some “operational disruptions”.
“In response to the attack, the hospital has activated the emergency response system and stepped up cyber security measures to block further intrusion … Union Hospital condemns any form of cyberattack,” the hospital said.
“A team of cybersecurity experts has been appointed to conduct a thorough system inspection and recovery in order to ensure medical service continuity.”
The hospital stressed that its staff had been vigilant over cybersecurity threats and ensured that all patient records were encrypted and password-protected.
“The leakage of patient data is unfounded as of now. An investigation into the attack is in progress,” it said.
The institution said it had reported the case to the department, the privacy commissioner and police, adding that patients with concerns could contact them at infosecurity@union.org.
Hackers reportedly used ransomware called “LockBit” to target the hospital and demand the US$10 million ransom, which the latter refused to pay.
Police said they had received a report from a hospital employee on Monday over abnormalities in the hospital’s network system, including some computer files going missing, but no personal data was involved.
The case is being investigated and no arrests have been made.