.webp)
On May 9, Ascension, a leading private healthcare provider managing 140 hospitals across the United States, confirmed experiencing a significant ransomware attack initiated by the Black Basta group. This cybersecurity breach was first detected the day before, May 8, because of unusual activity on the organization's network systems. The attack severely disrupted operations, leading to delays and postponements of patient appointments and other healthcare services. Ascension's swift detection and response reflects their in-place cybersecurity measures.
The cybersecurity breach at Ascension was likely facilitated through the exploitation of vulnerabilities, specifically highlighted by the use of CVE-2024-1709 in ConnectWise’s ScreenConnect by the Black Basta group. The initial signs of the breach were detected from unusual activity observed on the organization’s network systems, prompting an immediate investigation by cybersecurity teams. This early detection was critical in quickly addressing the threat and mitigating potential damage.
The ransomware attack had profound impacts on Ascension's operations, with the most significant being the inaccessibility of electronic health records and other critical operational software. The extent to which sensitive or confidential data was accessed or exfiltrated is still under investigation, with a commitment from Ascension to notify potentially affected individuals as soon as possible. The disruption caused considerable operational challenges, affecting the delivery of medical services and administrative functions within the organization.
In response to the attack, Ascension took swift measures to contain the ransomware and limit its spread by isolating affected systems. The organization's incident response plan was promptly activated, and notifications were sent to law enforcement and relevant federal agencies, including the Department of Health and Human Services. Ambulances were diverted to other healthcare facilities, and a reversion to paper records was instituted. There has been no disclosure about ransom demands or payments.
Ascension is currently restoring the affected systems and data with the help of cybersecurity professionals. This recovery process is expected to be cautious and thorough, emphasizing safety to avoid further complications. Although some elective procedures and tests are temporarily paused, all hospitals remain operational, providing necessary care under challenging conditions. It is uncertain how long it will take before systems are fully restored, but efforts are underway to minimize downtime and resume normal operations as quickly as possible.
To prevent future cybersecurity incidents of this magnitude, it is crucial for organizations, especially those in the healthcare space, to adopt several strategic actions. Effective vulnerability management, threat hunting, and establishing baseline behaviors within an organization's environment are critical components of a robust cybersecurity strategy. By implementing a comprehensive security process, organizations can identify and remediate potential entry points for cyber attackers, such as unpatched software or security gaps, thus significantly lowering the risk of breaches.
Additionally, proactive threat hunting enables security teams to actively search for and isolate emerging threats before they result in significant damage, employing advanced analytical tools and reviewing system logs to detect unusual patterns. Establishing a clear understanding of normal operations and user behaviors helps set a baseline that facilitates the swift identification of deviations, which might indicate malicious activities. This approach not only enhances an organization's ability to respond rapidly and effectively to incidents but also plays a crucial role in preventing potential security breaches, thereby maintaining the integrity and trustworthiness of its operations.
On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.
As we conclude our 'ransomware readiness week' of this Cybersecurity Awareness Month, it's time to take a critical look at your organization's defenses. Ransomware attacks are becoming more sophisticated, and no business is immune. In our latest article, we explore essential strategies to bolster your ransomware preparedness. Don't miss this vital information to help protect your business from emerging threats.
Ethical hacking has become an essential response to an IT industry kept on its toes by a spectrum of bad actors with malicious intent. This article introduces two prominent methodologies that help the good guys fight back: penetration testing (pen-testing) and red teaming. Learn more here.
Host Geoff Hancock was joined by guests Mike Rush, Director of Threat Intelligence at Access Point Consulting; and Evie Manning, Senior Director of Threat Hunting and Intelligence at Access Point Consulting. Together, they talked about cyber threat intelligence and the applications that can make it work for small and medium-sized businesses.
