AHA warns hospitals of potential cyberattacks due to Russia's invasion of Ukraine

Photo: Andrew Brookes/Getty Images

The American Hospital Association is warning U.S. hospitals of potential cyberattacks due to Russia's invasion of Ukraine.

"The AHA is closely monitoring the potential for increased cyber risks to the U.S. health system stemming from the ongoing military operations in the Russia/Ukraine region," the organization said. 

Leading up to Russia's invasion, threat actors deployed destructive malware against organizations in Ukraine to destroy computer systems and render them inoperable, the AHA said by statement on Saturday. These included malware known as WhisperGate and HermeticWiper, being used to target Windows devices and organizations in Ukraine.

"This has experts worried that U.S. hospitals and health systems could wind up being significantly affected as collateral damage, accidentally or even by design," the AHA said. 

One scenario: a third-party service provider with connections to Ukraine is an inadvertent conduit of malware or other cyber mischief into stateside healthcare systems. It also is possible that Russia could choose to ratchet up its longstanding cyber warfare against the U.S. in retribution for economic or other sanctions put in place this week, or give the green light to the multitude of ransomware gangs operating from Russia to target the west with impunity, the AHA said 

"While our attention is focused on Russia, other nation state cyber adversaries, such as China, Iran and North Korea, may see this an opportune time to strike," the AHA said. "Either way, cyber threats do not stop at water's edge, and care providers need to be on heightened alert during this tense time against malware or destructive ransomware that can penetrate U.S. health care, potentially disrupting patient care and putting entire systems at risk."
 
WHY THIS MATTERS

Steps hospitals should take include:

• Creating an incident response plan and continuity of operations plan – for up to four to six weeks – so that mission critical functions and operations can be kept running if technology systems are disrupted or need to be taken offline.
• Follow the top strategies for protective controls and secure, resilient and redundant offline backups, as well as multifactor authentication and vulnerability management.
• Take advantage of the tools and tips available on AHA's website, as well as federal law enforcement resources offered by the FBI, CISA and others. 

THE LARGER TREND

Over the past few years there has been an alarming increase in ransomware and other disruptive cyberattacks directed at hospitals and health systems that can interfere and delay care delivery and risk patient safety, the AHA said. 

Recently, the Cybersecurity and Infrastructure Security Agency warned that "every organization in the United States is at risk from cyber threats that can disrupt essential services and potentially result in impacts to public safety." 

On February 22, President Biden announced that Russia had invaded Ukraine.

The U.S. government and NATO allies immediately responded with a series of economic and military sanctions. Now there is a concern that Russia may retaliate against the U.S. and allied nations with disruptive cyberattacks in furtherance of its military and political objectives, the AHA said.

The Russian military has previously used cyberattacks against Ukraine to disrupt the electrical grid, communications capabilities and financial institutions. For example, it was reported that cyber denial-of-service attacks attributed to the Russian military were launched against Ukraine's Ministry of Defense, as well as its financial institutions.

In light of previous attacks and potential threats, the Cybersecurity and Infrastructure Security Agency last week issued a related and rare cyber "Shields Up" warning to the U.S. private sector, including healthcare, based on the increased cyber threat posed by the Russian government.

As part of AHA's efforts, John Riggi, the association's national advisor for cybersecurity and risk, and a former senior executive in the FBI's cyber division, remains in close coordination with the FBI, CISA and the Department of Health and Human Services regarding related threats which may pose a risk to U.S. healthcare.

Twitter: @SusanJMorse
Email the writer: SMorse@himss.org