Fraud Management & Cybercrime
,
Healthcare
,
Industry Specific
Ransomware Attack on Center Is Latest Assault on Blood Supply Chain

A New York blood center with divisions serving hospitals in several states is dealing with ransomware attack that is disrupting donations and related activities. The attack – the latest assault on a blood supplier – comes just days after the center declared a regional blood shortage emergency.
See Also: Advancing Cyber Resiliency With Proactive Data Risk Reduction
New York Blood Center Enterprises on Wednesday said it and its operating divisions on Sunday identified “suspicious activity” affecting its IT systems, which third-party cybersecurity experts quickly confirmed involved ransomware.
The center said it took immediate steps to help contain the threat and is working with external cyber experts to restore its systems “as quickly and as safely as possible.” The center also notified law enforcement.
The NYBCe operating divisions also affected by the attack collect and distribute blood to hospitals in at least seven states, including New York, New Jersey, Connecticut, Delaware, Rhode Island, Nebraska and Missouri.
Those NYBCe divisions include Blood Bank of Delmarva, Community Blood Center of Kansas City, Connecticut Blood Center, Memorial Blood Centers, Nebraska Community Blood Bank, New Jersey Blood Services, New York Blood Center and Rhode Island Blood Center.
NYBCe says it is one of the largest community-based, nonprofit blood collection and distribution organizations in the U.S., providing supplies and services including blood and stem cell products, transfusion medicine and cellular therapies.
“We understand the critical nature of our services, and the health of our communities remains our top priority. We remain in direct communication with our hospital partners and are implementing workarounds to help restore services and fulfill orders,” the center said.
NYBCe in a statement to Information Security Media Group said that its investigation into the full nature and scope of the incident is ongoing. “If we identify any sensitive personal information is involved, we will notify those individuals in accordance with the law,” NYBCe said.
The center did not immediately respond to ISMG’s request for more details about the attack, including the identity of the cybercriminal gang implicated in the incident.
The attack comes on the heels of NYBCe on Jan. 21 declaring a blood shortage emergency in New York and New Jersey.
NYBCe said it declared the blood emergency due to a significant drop in blood donations following an “alarming” 30% drop in donations in recent weeks resulting in 6,500 fewer donations, which has “crippled” the region’s blood supply.
“Donations of all blood types are urgently needed – especially Types O negative and B negative, which are down to dangerously low one- to three-day supply,” the blood center said.
While blood donations typically decrease during the holiday season, January faced additional challenges including bad weather that caused blood drive cancellations, as well as flu, COVID, and respiratory illness that reduced donor eligibility, the center said.
Other Attacks
The ransomware attack on NYBCe is the latest of several similar incidents involving blood supply entities in the U.S. and elsewhere. Those include an August ransomware attack on a Florida-based blood center OneBlood and an April attack on Octapharma Plasma, the U.S. operations of a Swiss pharmaceutical maker, also each disrupted blood collection and processing operations for several weeks.
Outside of the U.S., a June ransomware attack on Synnovis, a British pathology laboratory services provider, disrupted patient care and testing services at a number of London-based National Health System hospitals and other care facilities for several weeks. That incident ultimately caused the postponement and cancellation of thousands of procedures and appointments, and triggered a nationwide shortage of type-O blood supplies in the United Kingdom.
Russian-speaking ransomware groups were allegedly involved in each of those other attacks.
Cybercriminal have set their eyes on blood supply organizations for a few reasons, some experts said. “Blood centers are vital to hospitals, and any disruption can cause an immediate impact on the broader healthcare ecosystem,” said Scott Weinberg, CEO of managed services firm Neovera.
These organizations also store highly sensitive personal and medical data that are attractive to hackers, he said. “If the two are combined, it’s much more likely that these types of organizations will pay a ransom to restore operations quickly. But that doesn’t mean paying is always the right approach.”
Additionally, blood centers and many other health systems often use interconnected legacy IT systems and share data with different facilities, expanding the attack surface, he said. “Depending on the organization, budget constraints can result in limited cyber resources, too.”
Those earlier blood supply cyber incidents triggered several healthcare sector cybersecurity alerts from governments authorities and industry groups, including a bulletin from the Food and Drug Administration and a joint advisory from the Health Information Sharing and Analysis Center and the American Hospital Association (see: Attacks on Blood Suppliers Trigger Supply Chain Warning).
“The ransomware attacks on Synnovis, Octapharma, and OneBlood by Russian ransomware gangs caused massive regional disruptions to patient care,” said Errol Weiss, chief security officer at the Health ISAC. “The shortages of blood and plasma that these attacks brought delayed critical treatment and postponed important surgeries,” he said.
“Healthcare systems should consider alternative suppliers and have multiple suppliers to create redundancy if mission-critical blood suppliers are impacted by a cyberattack,” he said.
John Riggi, national cybersecurity adviser at the AHA, urged blood suppliers to implement strong cybersecurity defensive, resiliency and recovery plans and avoid the use of “exclusivity clauses” with their clients.
“Hospitals and health systems should identify all mission critical and life critical supply chain such as blood supply, and develop clinical continuity contingency plans for 30 days or longer, should that supply chain be disrupted,” he said.
Riggi also advised entities that get hit with such attacks to come forward.
“It is extremely important that the victims in these attacks be as transparent as possible with the federal government and cyber threat information sharing organizations, such as the Health-ISAC so we can collectively warn the entire sector and the nation to prevent future attacks.”