NEW YORK – Extortionist hackers who may be using leaked computer exploits from the U.S. National Security Agency infiltrated computers in dozens of countries in a fast-spreading attack that forced British hospitals to turn away patients and breached systems at Spain’s Telefonica SA and organizations from Russia to Taiwan.
The ransomware used in Friday’s cyber-attacks encrypts files and demands that victims pay $300 in bitcoin for them to be decrypted, the latest in a vexing style of security breaches that, at the very least, forces organizations to revert to backup systems to keep critical systems running. The malicious software has infected more than 75,000 computers in 99 countries worldwide on Friday, most of them concentrated in Russia, Ukraine and Taiwan, according to Dutch cybersecurity company Avast Software BV.
Security researchers at defense contractor BAE Systems said the attackers were using a vulnerability that has been patched, but attackers often take advantage of the fact that many organizations and individuals don’t routinely update their computers to fix security issues. Some security researchers said the exploit in the Microsoft Corp. system was published by the Shadow Brokers, a group that has been leaking stolen hacking tools purportedly from the NSA.
In the United Kingdom, hospitals urged people with non-emergency conditions to stay away after the cyber-attack affected large parts of the country’s National Health Service.
Sixteen NHS organizations were hit in the U.K. on Friday, while a large number of Spanish companies were also attacked using ransomware. In the U.K., hospitals urged people with non-emergency conditions to stay away after the cyber-attack affected large parts of the country’s National Health Service.
“The NHS has experienced a major cyber-attack, we are working with law enforcement and our advice will follow shortly!” Action Fraud, the U.K.’s central cyber-crime unit said on Twitter. The National Cyber Security Center said: “We are aware of cyber incident and we are working with NHS Digital and the National Crime Agency to investigate.”
Hospitals in London, North West England and Central England have all been affected, according to the BBC. Mid-Essex Clinical Commissioning Group, which runs hospitals and ambulances in an area east of London, said on Twitter that it had “an IT issue affecting some NHS computer systems,” adding “Please do not attend Accident And Emergency unless it’s an emergency!”
The impact on services is not due to the ransomware itself, but due to NHS Trusts shutting down systems to prevent it from spreading, said Brian Lord, a former deputy director of Government Communications Headquarters, the U.K.’s signals intelligence agency, who is now managing director of cybersecurity firm PGI Cyber. Lord, who described an attack of this type as “inevitable,” said the impact was exacerbated because most NHS Trusts had “a poor understanding of network configuration meaning everything has to shut down.”
A screen-shot of an apparent ransom message, sent to a hospital, showed a demand for $300 in bitcoin for files that had been encrypted to be decrypted.
Workers across the NHS have since been sent emails from the health service’s IT teams warning not to open or click on suspicious attachments or links.
Spain’s National Cryptologic Center, which is part of the country’s intelligence agency, said on its website that there had been a “massive ransomware attack” against a big number of Spanish organizations affecting Microsoft Corp.’s Windows operating system. El Mundo reported that the attackers sought a ransom in bitcoin.
“We’re aware of reports and are looking into the situation,” said a Microsoft spokesman.
Ransomware typically gets onto a computer when a person unsuspectingly downloads a file that looks like a normal attachment or web link. A hacker can then trigger the malware to freeze the computer, prompting a person to pay a ransom or lose all their files.
Hospitals have been a common target because the culprits know how critical digital records are for treating patients. There have been several incidents in the U.S., including one in Indiana where a hospital’s IT system was taken down and patients had to be diverted to other facilities, according to a local news report.
Ransomware attacks have also been soaring. The number of such attacks increased 50 percent in 2016, according to an April report from Verizon Communications Inc. These types of attacks account for 72 percent of all the malware incidents involving the health-care industry in 2016, according to Verizon.
“The large-scale cyber-attack on our NHS today is a huge wake-up call,” said Jamie Graves, chief executive officer of cybersecurity company ZoneFox.
Andrew Barratt, managing principal of Coalfire, a company which provides cybersecurity risk assessments to the health-care sector, said that many NHS hospitals used personal computers with outdated Windows-based operating systems, which have makes them easy to attack. He said many of these systems were too old to patch and that many NHS Trusts did not spend enough time on technical best practices and audits, leaving them vulnerable to a variety of potential cyber-attacks, including ransomware.
Robert Hutton, Jeremy Kahn and Jordan Robertson are reporters for Bloomberg News.
