A ransomware attack on Finger Lakes Health, based in Geneva, NY, has impacted the computer system to the extent that staff have had to work using pen and paper. In the meantime efforts to remove the malware and restore access to electronic data have been enhanced.
The health system came under attack from the health system beginning at around midnight on Sunday March 18, 2018, with workers first noticing the attack when a ransom demand was issued by the hackers.
Geneva General Hospital and Soldiers & Sailors Memorial Hospital in Pen Yan are managed by Finger Lakes Health. The entity also manages specialty care practices, primary care physician clinics, long-term health centers and day care centers in New York state. Many facilities have been impacted by the ransomware attack, though the precise number is not known.
Finger Lakes Health has employed emergency tactics for attack scenarios like this one, which were immediately put to work when the attack was identified. On March 20, the health system published a statement via local media channels about the attack stating that while some of its information systems were not accessible, its manual downtime protocol had been activated and its hospitals and care facilities continued to operate. Such an attack will, of course, have an effect on the supply of medical services, although patient care remains the main priority while the ransomware attack is tackled.
Finger Lakes Health is working alongside law enforcement and IT teams to restore access to data and bring its systems back to full capacity. Currently it appears that the attackers have only encrypted data. There is nothing to suggestthat any patient or employee information has been impacted.
No specific details on the type of ransomware used in the attack has been made public, nor how much money was sought by the attackers to supply the keys to unlock the encryption, although Finger Lakes Health’s vice president of community services, Lara Turbide, has revealed that the ransom was paid, saying “We made this decision in the interest of patient and resident care to minimize patient inconvenience and to move past this incident as quickly as possible”.