Missouri Hospital Is the Latest Victim of Ransomware
The ransomware attackers posted private patient information online, including Social Security numbers and medical information.
Photo via Adobe, by MarekPhotoDesign.com.
Sikeston, Missouri — Missouri Delta Medical Center confirmed on Friday that one of its servers was hacked by the Hive, a new ransomware group.
The attackers stole information from one of the medical center’s servers and began posting private patient information online on September 9, including patient Social Security numbers and medical information, reports STLPR.
The ransomware attack occurred just as practically all of Missouri Delta Medical Center’s ICU beds were full due to the region’s latest COVID-19 surge, reports KFVS. However, according to Missouri Delta, despite the awful timing, the attack appears to not involve data from the hospital’s main medical record system, so it’s not affecting the center’s ability to care for patients.
Last month the FBI issued an alert about the Hive. The group is believed to be responsible for a ransomware attack of Ohio’s Memorial Health System in August, which affected more than 600,000 patients, according to the U.S. Department of Health and Human Services Office of Civil Rights.
According to the FBI’s alert:
“Hive ransomware, which was first observed in June 2021 and likely operates as an affiliate-based ransomware, employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Hive ransomware uses multiple mechanisms to compromise business networks, including phishing emails with malicious attachments to gain access and Remote Desktop Protocol (RDP) to move laterally once on the network.
“After compromising a victim network, Hive ransomware actors exfiltrate data and encrypt files on the network. The actors leave a ransom note in each affected directory within a victim’s system, which provides instructions on how to purchase the decryption software. The ransom note also threatens to leak exfiltrated victim data on the Tor site, ‘HiveLeaks.’”
The alert also outlines how victims should respond to this type of attacks. The FBI encourages victims to report when they have been attacked but does not recommend paying the ransom.
If you appreciated this article and want to receive more valuable industry content like this, click here to sign up for our FREE digital newsletters!
About the Author
Robin Hattersley, Editor-in-Chief
Robin has been covering the security and campus law enforcement industries since 1998 and is a specialist in school, university and hospital security, public safety and emergency management, as well as emerging technologies and systems integration. She joined CS in 2005 and has authored award-winning editorial on campus law enforcement and security funding, officer recruitment and retention, access control, IP video, network integration, event management, crime trends, the Clery Act, Title IX compliance, sexual assault, dating abuse, emergency communications, incident management software and more. Robin has been featured on national and local media outlets and was formerly associate editor for the trade publication Security Sales & Integration. She obtained her undergraduate degree in history from California State University, Long Beach.
Related Content
Leading in Turbulent Times: Effective Campus Public Safety Leadership for the 21st Century
This new webcast will discuss how campus public safety leaders can effectively incorporate Clery Act, Title IX, customer service, “helicopter” parents, emergency notification, town-gown relationships, brand management, Greek Life, student recruitment, faculty, and more into their roles and develop the necessary skills to successfully lead their departments. Register today to attend this free webcast!
