Ohio Health System Responding to Cyberattack, Fraud Scams

Kettering Health is in its second day responding to a cyberattack that’s disrupted patient care services and downed its IT systems, including its patient portal and phones.

See Also: Forrester Top 35 Global Breaches Report: Balance Defense with Defensibility

Media reports claim the incident involves ransomware encryption and data theft, and some security experts suspect newcomer cybercriminal gang Interlock to be at the center of the attack.

Kettering said Tuesday that it experienced a system-wide technology outage that limited its ability to access certain patient care systems. “We have procedures and plans in place for these types of situations and will continue to provide safe, high-quality care for patients currently in our facilities,” Kettering said.

On Tuesday, elective inpatient and outpatient procedures at Kettering facilities had been canceled. Emergency rooms and clinics were open. Kettering’s call center is still experiencing an outage and may not be accessible, the organization said.

In a late Wednesday update, Kettering said that its patient procedures are being evaluated on a case-by-case basis, “with safety as our highest priority.”

Kettering said it has no evidence that personal cell phone apps, like MyChart, or the information in them have been compromised. “Kettering Health will never reach out to staff or patients via social media,” the organization said.

Affiliated with the Seventh-day Adventist church, Kettering operates 14 medical centers and more than 120 outpatient facilities in western Ohio, and has more than 1,800 physicians and 15,000 employees.

The healthcare system warned patients of scam calls from fraudsters pretending to be medical bill collectors from the organization requesting credit card payments.

“Out of an abundance of caution, we will not be making calls to ask for or receive payment over the phone until further notice,” Kettering said. “We encourage anyone who receives a scam call to report it to local law enforcement.”

Kettering said it has not confirmed whether the scams are related to the IT outage.

Malicious attackers are opportunistic and take advantage of any situation, whether they are directly involved in an incident or not, said Mohammad Waqas, CTO of healthcare at security firm Armis.

It’s not necessary for fraudsters to be involved in carrying out the actual cyberattack. “Patients are expecting calls to reschedule their appointments for which cancellations were communicated by Kettering,” and the cybercriminals “are simply leveraging those expectations,” he said.

Ransomware Suspected

CNN and Ohio local news media outlets report that the Kettering attack involves ransomware encryption and data theft.

Cybercriminals threatened to destroy and leak stolen data within 72 hours if Kettering did not pay a ransom demand, reported the Dayton Daily News.

A Kettering spokeswoman declined to provide details about the incident, including whether the attack involves ransomware.

Jeff Wichman, director of incident response at security firm Semperis, said some cybersecurity insiders are pointing a finger at Interlock, a newer ransomware gang, as the primary culprit in the Kettering incident (see: Ransomware Leak Sites Suggest Attacks Reached Record High).

That same cybercrime group recently claimed to have attacked DaVita, a kidney care and dialysis services provider with nearly 3,000 centers across the U.S. (see: Ransomware Attack Disrupts Global Dialysis Provider).

Interlock’s typical attack pattern is credential-based access, usually through phishing or exposed remote desktop protocol or VPN accounts. It deploys lateral movement tools such as Cobalt Strike or Sliver, said Scott Weinberg, CEO and founder of managed services firm Neovera. “From there, they exfiltrate data before encryption,” he said.

“So far, there’s no indication this was some novel zero-day or supply chain attack. It looks like a classic exploit, taking advantage of legacy systems, flat networks and human error. It fits the same pattern we’ve seen again and again in this sector,” he said.

Anytime hospitals are forced to cancel elective inpatient and outpatient surgeries and procedures, patients’ lives are at risk, Wichman said. “The good news is that Kettering’s emergency rooms and clinics have remained open, even if staff use pencils and paper to complete patient visits,” he said.

Kettering Health is the latest among a long and growing list of other healthcare sector entities that have suffered cyberattacks in recent months and years that have often resulted in patient care disruptions as well as serious data breaches.

“The healthcare sector has been in the crosshairs of ransomware gangs for years,” Wichman said.