Explained: What's Happening At AIIMS After Sensitive Ransomware Attack?

All India Institute of Medical Science (AIIMS), Delhi has been forced back in time after a cyber-attack took all of its servers offline. While it's unclear who's behind the attack, Delhi Police refuted various reports that claimed hackers were demanding a Rs. 200 crore crypto ransom to loosen their grip.

Sumit Yadav on Google

What went wrong at AIIMS?

On November 23, 2022, a breach was detected in AIIMS' internal systems. Not much later, the hospital's digital patient management system was crippled. In a statement, AIIMS confirmed the hack, adding that data restoration is taking time owing to the large number of servers used by the hospital that cater to 15 lakh outpatient and 80,000 inpatient cases each year.

Such data is extremely sensitive, for it includes the personal credentials of all patients - their names, age, sex, address, phone number, medical history. Hackers could easily put this sensitive information for sale on the Dark Web, if they haven't already done that.

"Since AIIMS has reported that some of their files are encrypted, it is possible that it is a ransomware attack. There are a few ransomware groups that are actively targeting Indian entities, and one of these groups could have targeted AIIMS," said a representative of CloudSEK, a contextual AI company that predicts cyber threats.

Also read: Hackers Demand Rs 200 Crore In Crypto From AIIMS Delhi As Server Remains Down For 7th Day

By December 1, 2022, AIIMS servers continued to remain offline for patients. But authorities on Tuesday said that the e-hospital data has been restored, and they're now sanitising the servers before making them operational.

Pexels

Far-reaching effects of this cyberattack

Have you been wondering how this hack affects the general public? Besides the aforementioned threat of data leak, the hack has caused a rush at AIIMS. According to a PTI report, long queues rocked AIIMS as its online appointment system remained offline.

The hospital had to deploy additional staff to help with the rush. All of the hospital's services, including outpatient and in-patient departments and labs continue to operate manually. Billing counters and diagnostic centres saw long queues after the server outage continued after a week.

Pexels

On November 25, Delhi Police's Intelligence Fusion and Strategic Operations (IFSO) unit filed registered a case of extortion and cyber terrorism.

Also read: Server Vulnerability Allows Chinese Hackers To Target India's Energy Sector: Microsoft

AIIMS officials have reportedly roped in IT companies and bodies to probe the ransomware attack. An AIIMS official told Mint that various agencies in talks with the hospital include National Investigation Agency, India Computer Emergency Response Team (CERT-IN), Delhi Police, Defence Research and Development Organisation, Intelligence Bureau, Central Bureau of Investigation, and the Ministry of Home Affairs.

Ransomware is a type of malware that blocks access to data or a computer system and threatens to publish it. Once hacked, this data becomes encrypted until demands of the hackers are met.

Pexels

What's happening at AIIMS now?

Now, AIIMS will have to go through each system on the network to ensure there is no malware left. This is a long-drawn process, and with a hack of this gravity, it could still take a long time before servers are back on.

Also read: Hackers Just Took Down One Of The World's Most Advanced Telescopes

Data of about 3-4 crore patients may have been leaked in this hack, PTI reported, adding that hackers remained adamant on their Rs. 200 crore demand.

Pexels

For now, internet services remain blocked at AIIMS. "AIIMS has around 40 physical and 100 virtual servers. Five have shown signs of virus infection. These servers are also being set up for scanning and new servers with updated configurations are being purchased as most servers at AIIMS were end of life/end of support," a source was cited by PTI.

What can institutions do to avoid such attacks?

"Given the scale and significance of the healthcare industry, it is vital for institutions, employees, and healthcare professionals to ensure that the data they gather and store is not leaked or exploited by cybercriminals," a CloudSEK rep said.

CloudSEK also listed out precautions that healthcare organisations can take to prevent such attacks in the future:

1. Creating awareness among users regarding cyber-attacks, online scams, and phishing campaigns
2. Enacting strong password policies and enable multi-factor authentication (MFA)
3. Updating and patching software, systems, and networks regularly
4. Maintaining multiple backups - both online and offline in separate and secure locations
5. Monitoring logs for unusual traffic and activity to websites and other applications
6. Blocking illegitimate IP addresses and deactivating port-forwarding using network firewalls
7. Performing real-time monitoring of the internet to identify and mitigate low-hanging threats such as misconfigured apps, exposed data, and leaked accesses that are leveraged by cybercriminals to carry out large-scale attacks
8. Avoid clicking on suspicious emails, messages, and links
9. Refrain from downloading or installing unverified apps
10. Using strong passwords and enable multi-factor authentication (MFA) across accounts

What do you think about the sensitive hack that has rocked AIIMS? Let us know in the comments below. For more in the world of technology and science, keep reading Indiatimes.com.

References

Tribune News Service. (2022, November 30). AIIMS-Delhi servers remain down for 8th day; 20 per cent rise in walk-in OPD patients. Tribuneindia News Service. https://www.tribuneindia.com/news/delhi/aiims-delhi-servers-remain-down-for-8th-day-20-per-cent-rise-in-walk-in-opd-patients-456323

Thathoo, C. (2022, November 29). Hackers Demand INR 200 Cr Crypto Ransom From AIIMS, Delhi Police Refutes Claims. Inc42 Media. https://inc42.com/buzz/aiims-delhi-servers-down-for-sixth-day-hackers-demand-inr-200-cr-in-crypto/

Edit, T. (2022, November 29). Held to ransom: Healthcare sector is a sitting duck to cybercriminals. AIIMS and other hospitals must shore up. Times of India Blog. https://timesofindia.indiatimes.com/blogs/toi-editorials/held-to-ransom-healthcare-sector-is-a-sitting-duck-to-cybercriminals-aiims-and-other-hospitals-must-shore-up-security-systems/

Team, W. B. S. (2022, December 1). AIIMS reaches out to IT companies to probe ransomware attack: Report. www.business-standard.com. https://www.business-standard.com/article/current-affairs/aiims-reaches-out-to-it-firms-to-probe-the-ransomware-attack-report-122120100487_1.html

Banerjee, P. (2022, December 1). How did hackers cripple AIIMS so much? | Mint. Mint. https://www.livemint.com/news/india/why-the-aiims-cyberattack-was-so-devastating-11669910448876.html