Ransomware Attack at German Hospital Leads to Death of Patient

A person in a life-threatening condition passed away after being forced to go to a more distant hospital due to a ransomware attack.

On September 10th, the Duesseldorf University hospital in Germany suffered a ransomware attack after threat actors exploited a software vulnerability in “a commercial add-on software that is common in the market and used worldwide.”

With their IT systems disrupted, the hospital announced that planned and outpatient treatments and emergency care could not occur at the hospital.

Those seeking emergency care were instead redirected to more distant hospitals for treatment.

Also Read: The Scope of Singapore Privacy: How We Use It In A Right Way

German media reports that the police contacted the ransomware operators via the ransom note instructions and explained that their target was a hospital.

The ransom notes left on the hospital’s encrypted servers were incorrectly addressed to Heinrich Heine University, rather than the hospital itself.

After the police contacted the threat actors and explained that they encrypted a hospital, the ransomware operators withdrew the ransom demand and provided a decryption key.

“The Düsseldorf police then actually made contact and informed the perpetrators that a hospital – and not the university – was affected by their hacking attack. This puts patients at considerable risk. The perpetrators then withdrew the extortion and handed over a digital key with which the data can be decrypted again,” German media NTV reported.

Since receiving the key, the hospital has slowly been restoring systems, and investigations concluded that data was likely not stolen.

Patient dies after forced to go to another hospital

NTV reports that a patient in a life-threatening condition was redirected to a more distant hospital after Duesseldorf University hospital deregistered its emergency services.

This disruption led to the patient receiving care an hour later, which may have led to their death.

Due to the death of the patient, German prosecutors are investigating this attack as a negligent manslaughter.

“Prosecutors launched an investigation against the unknown perpetrators on suspicion of negligent manslaughter because a patient in a life-threatening condition who was supposed to be taken to the hospital last Friday night was sent instead to a hospital in Wuppertal, a roughly 32-kilometer (20-mile) drive. Doctors weren’t able to start treating her for an hour and she died,” AP news reports.

Also Read: The Importance of DPIA And Its 3 Types of Processing

Some ransomware state they won’t attack healthcare

At the beginning of the Coronavirus pandemic, BleepingComputer reached out to different ransomware operations to see if they would continue to attack healthcare and medical organizations.

The CLOP, DoppelPaymer, Maze, and Nefilim ransomware operators stated that they would not target hospitals, and if one was encrypted by mistake, they would provide a free decryption key.

“We always try to avoid hospitals, nursing homes, if it’s some local gov – we always do not touch 911 (only occasionally is possible or due to missconfig in their network). Not only now.”

“If we do it by mistake – we’ll decrypt for free,” the DoppelPaymer ransomware operators told BleepingComputer.

Netwalker also stated that they do not target hospitals, but said that if they encrypted one by accident, the hospital would still need to pay the ransom.

“If someone is encrypted, then he must pay for the decryption,” Netwalker told BleepingComputer.

Even still, after making these promises, we continue to see attackers targeting hospitals without any concern for the health of their victim’s patients.