Cyber-attackers target French hospitals under pressure from Covid crisis

Some French hospitals struggling with the coronavirus epidemic have recently come under attack by another kind of virus: cyber-attacks that cripple information systems as criminals exploit hospitals already under pressure to demand ransoms in exchange for returning the systems to normal.

The hospital in Villefranche-sur-Saône north of Lyon suffered such an attack on Monday, crippling computer and telephone networks and forcing it postpone all surgical operations planned for the following day and send emergency patients to other establishments.

A similar attack last week crippled medical, financial and communications networks of the hospital in Dax in southwestern France. National cybercrime investigators have opened probes for both incidents.

Exploiting Covid crisis

While patients have not been directly affected by the attacks, hospitals have warned of indirect consequences for those needing treatment, including those suffering from Covid-19.

The disease has not only put hospitals under extreme pressure in terms of patient care but has also made them more likely targets of cybercriminals.

“If you're a hospital director dealing with a Covid crisis and all of a sudden the information systems are blocked, maybe you would rather pay a hundred-thousand-euro ransom than deal with a hospital that cannot function for three or four days,” says Vincent Trély, president of Apssis, an association of information security experts in the health sector.

“Perhaps there is the idea that the more attacks there are on strained systems, the more likely it is a ransom will be paid.”

Attacks on the rise

Such attacks pre-date the Covid pandemic – the university hospital in the city of Rouen suffered a major attack in 2019 – but national information security agency Anssi has noted hackers have been more active in recent weeks and months.

“It's accelerated over the past two months, with a new hospital now being attacked every week,” Trély says. “Before, for the past three or four years, it was more like one case per month, which is already a lot.”

France is not alone in facing a rising trend in attacks, most of which Trély says are the work of groups operating in Russia, China, Eastern Europe, North Korea.

The FBI and other agencies issued an alert about ransomware attacks targeting the United States health care sector last October. Attacks have also hit hospitals in the states of California, Minnesota New York, Oregon and Vermont, as well as in the Canadian city Montreal.

Trély says similar attacks have also been affecting town halls in many small to mid-size French cities, though hospitals are getting more of the unwanted attention because of the health crisis.

“It's pure cybercrime, looking for money, and it's not hard to put into place,” Trély says. “You don't need to be a large state agency or a large group of highly skilled hackers to carry out a ransomware attack.”

Keeping systems updated

It can take a hospital several weeks to restore compromised systems. Officials in the south-west already said they would not pay a ransom, following a key recommendation of experts.

“Above all, the ransom must not be paid, because that guarantees the attackers will persist,” Pierre Delcher, researcher with global cybersecurity firm Kaspersky, told RFI. “There is also no guarantee the attacker will call off the attack.”

Hospitals are calling for more assistance in being protected from attacks.

“The solution is to remain vigilant, to better protect oneself, to build more efficient systems, but we know that it's a game of cat-and-mouse,"  the president of France's hospital federation Frédéric Valletoux told Franceinfo radio this week in an appeal for more government support.

“Hospitals must be included in the list of targets with top-level protection,” he said. “I've been asking this of the government for some time now.”

Trély says hospitals could do more to improve their security by ensuring hardware and software are up to date and doing more to teach staff basic information security practices, such as changing passwords every three months.

“Many experts say that if all systems were correctly updated and people were aware of security risks, it would take care of 95 percent of the problems,” he says, adding the issue is about minimising exposure to risk.

“You could have the best hospital with the best technicians and the best equipment, and if a group of experienced hackers decided it was your turn, you'd be in trouble,” he says. “But most little problems would be solved, because most ransomware attacks obsolete systems.”