Ransomware Hits Hundreds of Dentist Offices in the US (zdnet.com) 76
Hundreds of dental practice offices in the US have had their computers infected with ransomware this week, ZDNet reported Thursday. From a report: The incident is another case of a ransomware gang compromising a software provider and using its product to deploy ransomware on customers' systems. In this case, the software providers are The Digital Dental Record and PerCSoft, two Wisconsin-based companies who collaborated on DDS Safe, a medical records retention and backup solution advertised to dental practice offices in the US. Over the last weekend, a hacker group breached the infrastructure behind this software, and used it to deploy the REvil (Sodinokibi) ransomware on computers at hundreds of dentist offices across the US. The security breach came to light on Monday, when dentists returned to work, only to find out they couldn't access any patient information. A source impacted by the ransomware tells ZDNet that the two companies opted to pay the ransom demand. The Digital Dental Record and PerCSoft have been sharing a decrypter with impacted dental offices since Monday, helping companies recover encrypted files.
'opted to pay the ransom demand' (Score:3)
Re: (Score:1)
Yeah well, until proper backups are made, on and off site, there isn't a lot of choice. Business is business.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Well, in any case, this should come with a huge cost to them. The reason that attack was possible is that they were too greedy and did not invest into adequate IT security. I would say, estimate what decent security would have cost them, then fine them 3x that much and require them to fix their infrastructure. Then yearly independent audits for 10 years and if they do this crap again, repeat the fine.
And yes, paying for this should be a federal crime.
Re:'opted to pay the ransom demand' (Score:4, Insightful)
then fine them 3x that much and require them to fix their infrastructure.
Fine them, for begin victims of a crime??? So if you don't invest in adequate security for your house, buying cheap locks for your doors, and someone breaks in while you're away and steals your stuff, then in addition to losing your possessions, you should be fined as well? After all, the burglars could sell the stuff they stole from you and use the proceeds to expand their criminal organization!
Re: (Score:1)
False equivalence. In your fake scenario, the victim does not then fund additional terrorism out of their own pocket in a vain attempt to get their shit back.
Re: (Score:3)
Fine them, for begin victims of a crime???
No, fine them for being grossly negligent and funding crime. Then require them to pay the dentist offices their full ongoing operating costs until the dental offices have rebuilt their databases (probably from scratch) and are whole again.
Do that one or twice, and I think they would resolve their security issues.
Re: (Score:1)
No, fine them for being grossly negligent and funding crime.
Exactly. They are not victims. They are perpetrators. Gross negligence is pretty much the same as intent here.
Re: (Score:3)
Re: (Score:3)
The Feds are certainly welcome to open an investigation in
Re: (Score:1)
You think falling for this a third time in a row isn't proof enough? Consider how much cheaper some spare harddrives for backups would have been the first and second times.
Re: (Score:2)
Re: (Score:2)
You're not wrong.t [forbes.com]
Smile as you pay me money (Score:2)
The Cloud (Score:5, Insightful)
Re: (Score:2)
I would think that this more of a cautionary tale for managed service providers.
The Dental offices aren't on the hook. Actually, this is why dentists pay someone else to take care of things.
Re: (Score:1)
Re: (Score:1)
Some sort of encrypted file at the end of every shift that's not fully networked/on the cloud?
Indeed (Score:3)
Dentists were never hacked en masse before they used cloud services. Here is a reminder why it may be bad to use one; you become part of a bigger target.
Cloud services seem to be enabling this burst of criminality, not suppressing it. You're collecting the high-value data of clients online where there are more attack vectors to compromise that data. Online = At Risk, and More Convenience = Less Security. Every time. So I'm getting tired of hearing all these pitches about how "The Cloud" is the answer to our security problems. We keep forgetting that the Cloud isn't this magic thing, it's just a slick marketing term for "someone's servers".
Re: (Score:2)
Dentists were never hacked en masse before they used cloud services. Here is a reminder why it may be bad to use one; you become part of a bigger target.
Dentists were never hacked when they had all their records on paper.
Dentists were never hacked before people/insurance started paying to unencrypt files.
The cloud has about as much to do with this as the tooth fairy.
They were targeted because they are not secure and because they have lots of records that they need to do business. Patient history, x-ray imagines, etc.
It doesn't take a "cloud" to look-up easy targets. Small local governments, and now apparently dentists have been added to the list.
Sounds lik
Re: (Score:1)
they have lots of records that they need to do business. Patient history, x-ray imagines, etc.
Indeed. My dentist looks at my x-rays and then imagines that I need all sorts of work that isn't actually necessary.
But to be fair, he does have boat payments to make.
Re: (Score:2)
Dentists were never hacked en masse before they used cloud services. Here is a reminder why it may be bad to use one; you become part of a bigger target.
What do cloud services have to do with this story? If anything, cloud services would have prevented loss of data. They got hacked because their security got breached, nothing to do with any cloud.
Re: (Score:2)
Yep... cloud hosted is a bigger and bigger target. I'm calling inside job with the devs, but that's just pure speculation.
And the dentists are not functioning for days waiting for stuff to come back up??? This is why you hire someone, even if just part time consulting, in the IT world to help you out. If you hire someone you can trust, you'd have backups at least.
Re: (Score:2)
What I told my dentist when he asked me several years ago: Stay with the paper-based system, because that every educated person can understand and master.
Dentists / Dockers are dumb with IT and software n (Score:2)
Dentists / Dockers are dumb with IT and some of there software needs things like local admin. In the past some of it was stuck on XP.
They are also are independent so they have to do there own IT work or out source it as well.
Re:Dentists / Dockers are dumb with IT and softwar (Score:4, Interesting)
I've worked with dentists and orthodontists and they're some of the worst clients.
They have all the arrogance of "I'm a doctor", plus its amped up because they have a chip on their shoulders about not being *real* doctors. Some added amplification for orthodontists for their specialty status and further gap from any actual medical practice besides braces.
Worse yet, they're all penny pinchers as bad or worse than most any other small business owner. Never want to pay for any desperately needed upgrades, the server is always jammed into the worst location. The "high tech" ones want PCs in every patient treatment area, but have cabinetry/facilities from the 1970s with no room/no power/no networking.
They also have the worst vertical market software. I haven't dealt with this Wisconsin outfit mentioned here, but I've dealt with others and they're all based in some weird rural place and their software sucks. Bad compatibility, bad support, slow, just awful. I'm sure the dentists all buy this stuff based on whoever has the lowest cost products.
And from a support perspective, they're often open weird hours, and want you to do upgrades in tiny windows when there's some office manager there, but no patients, and there's little flexibility about this -- because it would mean paying the $12/hr office manager extra money to be there, probably, I guess so I don't huff on nitrous oxide or steal dental floss.
Re: (Score:2)
Re: (Score:2)
They're like every other small business guy. They don't think about the business, they just think of it as a cash machine.
I suppose one thing that impacts this is how fucking capital intensive a dentist office is in terms of equipment, tools and even stuff like insurance.
And I suppose your dentists under about 50 are buried in student loans and probably even the buy-in to get a chunk of a practice or the capex expenditure to get the place off the ground.
Re:Dentists / Dockers are dumb with IT and softwar (Score:4, Interesting)
Of course you can use their Arrogance against them, to get what you want. I will often play dumb with doctors, I know what I want to do, but they want to come up with the solution. So I give them data all pointing to what I want to do, while I act like there are many good options available. When they start straying, Ill happen to find some more information to put them back into making the conclusion I already made.
That way they feel they had made this big decision, while you guided them all the way there.
If you are vendor, try to be first, that way your product is stuck in their head as the baseline.
With options give them you best option first
Re: (Score:2)
Yeah, the vertical stuff sucks. Seriously. My SO is an orthodontist, and she can't even use 3rd party payment systems, because the vendor refuses to integrate with them.
Re: (Score:2)
Doctors in general (MD, Dentists, Professors,...) Have an ego problem that makes it really bad for their IT Infrastructure.
Good IT in general doesn't require brain power per say, but experience. Advanced degrees usually creates a focus on a particular area, however with Dr in front of your name, society treats you like a smart person, where you are expected to know the answer, even in areas which you have no experience in.
What is worse is we all fall for this, and actually believe that we are smarter then
Re: (Score:2)
I am not disagreeing with that. The overall problem is a lack of trust in the Specialist, If you are a Doctor or a Lawyer, Trust the IT guy to do their IT job, if you are an IT Guy, don't try to make Medical and Legal decisions. When you need to use computers to help you do your own specialty better, you need to work with the IT Guy to make sure what you want done is possible. As well the IT Guy just can't make a product for a doctor or a lawyer without fully understanding that problems that needs to be f
Re: (Score:2)
Dentists / Dockers are dumb with IT and some of there software needs things like local admin. In the past some of it was stuck on XP.
They are also are independent so they have to do there own IT work or out source it as well.
If you're dumb with IT, outsourcing makes sense. It's not unreasonable, but a little naive, to assume that your IT provider is taking care of security and data recovery.
Re: (Score:1)
Came here to say this, the medical profession sees IT as a bothersome and wholly unnecessary expense and will neglect everything to within an inch of its life (on top of the common problem of equipment interface software being a total shitshow), so rampant ransomware infections don't surprise me in the slightest. Serves 'em right I say, maybe having to defer the purchase of that nice supercar they were looking at will teach them the value of maintaining their IT systems.
Two questions (Score:3)
2) Operating Systems? What are the affected OSes and how were they hacked?
Re:Two questions (Score:4, Insightful)
1) "a medical records retention and backup solution" Where are the backups?
I'm betting the infected client encrypted the backups too. And probably did for over a month.
This is almost certainly the case. Which is why I keep a month's worth of supplemental backups on USB drives (using Robocopy for the files instead of normal backup software for permanently attached backup drives), scan them for malware, then unplug and store them in another part of the facility until it's time to do it again.
Re:Two questions (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Well since in your case a client was compromised, and it started performing encryption of data on a fileserver - a versioning filesystem on the server would have saved that, since the client would only be able to create new (encrypted) versions, with the server retaining the previous versions.
Re: (Score:3)
Hard to pull off. Dentists often run more than just a scheduling/records package, they often run some 3D modeling/imaging software for making crowns, or software for braces (if they do braces, too), and it's all windows based and some of it is tied to the hardware devices (like the crown tooth scanner).
The real efficiency would be a records/patient management system with a boot-from-USB kind of turnkey ease of use. The existing systems are super clunky, and one based on Linux isn't going to get any tracti
Someone going to get drilled for this... (Score:5, Funny)
Re: (Score:1)
Who are you? Jimmy TwoTimes?
Does that mean my tooth-hurty appointment is off? (Score:2)
Sorry couldn't resist!
Re: (Score:2)
"You may feel a little pinch" (Score:4, Funny)
Re: (Score:2)
Strange, I've only wanted to say that to some hygienists.
Re: (Score:2)
Urgent Memo from IT (Score:2)
Urgent Memo from the IT department:
To: All Employees
Please stop downloading porn at work on our computers. You are causing lots of problems. All of you.
Thanks.
IT
Re: (Score:2)
Re: (Score:2)
I won't hurt a bit (Score:2)
Or perhaps it will.
Not surprised at this in the least... (Score:3, Interesting)
One orthodontist I went to was still using 3270 terminals (yes, true IBM 3270 terminals with the little switches and red LED lights around it, and Medeco keylocks where the secretary took the key home with her). The mainframe communication went via a dedicated serial line to another city. This setup has been working the same way since the 1970s.
Sometimes it makes me wonder if going back to the mainframe may not be such a bad idea after all. The 3270 terminal doesn't use the Internet for anything, unless the telco routes traffic via a link, and someone trying to get in would need access at that physical site, and be able to guess the password (which changes monthly) in three tries, otherwise the terminal and account are locked until someone calls in and has it reset. Even the physical terminal has a physical key to it, so someone would have to either pick the Medeco cam lock, or crack the case and jumper it.
The graphics are nonexistent, but the terminal is extremely responsive, so once someone gets used to the key sequences, they can go through transactions extremely quickly.
Wish IBM would price the iSeries machines at a reasonable level that businesses can afford. With all the ransomware going on, having something based on a secure stack might be useful.
Re: (Score:3)
iSeries isn't mainframe though. it's the midrange formerly known as AS/400. many places will call their midrange (unix box or i series "the mainframe" but it isn't
Actual mainframe, the z-series would be very expensive. As in over a million dollars for hardware initial capital cost, then another million each year for software plus hardware maintenance. That's for places with few thousands of apps and/or tens of thousands or more users.
Re: (Score:2)
Agreed. iSeries is POWER. It does a great job at limiting what hanky-panky happens at the endpoints.
I should have been more specific, since this orthodontist uses a mainframe, but an i-Series would be an upgrade, provided it is locked away and only people who know what they are doing be allowed in... everyone else gets a terminal.
Re: (Score:2)
it's claimed that mainframe apps and virtual machines can be locked down tighter than an i-series (or any other midrange or big iron unix) though.
Serial link (Score:2)
Re: (Score:2)
Yes, there are ways to attack the connection, and serial has its items, but most successful compromises are at the endpoints. By going back to terminals, it limits the damage users can do, and an attacker would have to go after the telco or the mainframe provider to be successful.
Don't pay (Score:2)
If you pay, this will keep happening.
That is all.
Re: (Score:2)
It can be argued that paying the ransom is cheaper than a backup system.
Who are you going to pay when your hard disk crashes? No, a data recovery service isn't going to work in all, or even in most cases.
Icky 'ransomware cooties' (Score:2)
Can you trust the data once it's unlocked? How do you know they didn't do other things to the data like make subtle changes to dosage amount, etc, something that most human eyes won't pick up on but can kill the patient?
I would consider the data to be forever contaminated, and see fit to wipe and restore from an earlier (non contaminated) backup. Your organization does back up their drives on a regular basis and keep paper copies of all patients' info, right?
No worries here (Score:2)