On January 9th, 2005, the Donttrip malware infection hit Northwest Hospital,¹ a large medical facility in Seattle that served thousands of people. The malware clogged up the hospital’s network systems with surges of exploit network scanning. Medical operations ground to a halt as laboratory diagnostic systems couldn’t transfer data, Intensive Care Unit terminals went offline, internal pagers were silenced, and even the automatic operating room doors were locked down. The IT team bailed valiantly against the sinking ship, but as soon as they cleaned a machine and put it back on the network, it got re-infected. Staff moved to implement disaster recovery processes, using manual or backup systems to bypass the affected systems. The quality of patient care was diminished, but no lives were seriously endangered, and the hospital weathered the storm. The FBI swooped in, eventually arresting the guilty parties, and the word went out: hospitals can be affected by cyber-incidents.

In April 2017, a 1,000-bed hospital in Buffalo, New York was virtually shut down by a ransomware attack.² Then on May 12th, 2017, the WannaCry ransomware pounded through Europe like a tsunami, leading to substantial IT outages. WannaCry was particularly devastating to UK’s National Health Service, disrupting over a third of health-serving organizations at 603 primary care facilities.³With the proliferation of complex IT in healthcare on highly critical but widely open networks, it is no surprise that their systems are at such high risk. Ransomware had proven itself as an existential threat to medical service delivery in modern hospitals.

First off, we’ve talked about the insecurity of the Internet of Things, and I had concerns about all the medical gear like scanners and monitoring devices they wheeled around and used on patients. It turned out that much of that equipment was air-gapped away from the main network. Most of this equipment was manually controlled, requiring a live operator to enter commands. Old fashioned, yes, but no malware was going to infect an IV feed and overdose a patient. To retrieve data, nurses used a very regimented manual process to capture and record readings from these systems. The amount of data captured was also very small, usually a short series of numbers, which reduced mistakes in the handoff. Over the course of weeks, I observed dozens of different medical professionals executing the same manual process in the same exact way.