According to Euro Weekly, according to experts a cyberattack on Barcelona hospital originated from outside of Spain.
This was announced in a press conference by Sergi Marcen, the Secretary for Telecommunications and Digital Transformation of the medical facility who described the attack as ‘complex and transversal’ and explained that it came from a cybercrime company called Ransom House.
“Normally, Ransom House carries out these types of attacks in exchange for money, but so far they have not been in contact”, said Marcen. As a result of the attack, about 150 elective surgeries, 500 extractions and some 300 external consultations are still unscheduled. Urgent cases such as heart attacks or strokes will be redirected to other medical facilities. Officials warned that they do not know exactly when they will be able to recover full activity.
When emergency services are forced back to pen and paper, the situation is in itself an emergency. With no indication of when services will be back online and with other surgeries across Spain affected by the attack, it highlights the devastating real life impact of a cyberattack. It’s been nothing short of a miracle that there hasn’t been a documented case of untimely death directly caused by a ransomware attack yet.
With data leaked and services still down, a ransom is highly likely to surface soon. However, when hospitals are struck with ransomware, they often have less funds to play with and therefore ransom payments are rarely met.
When government organisations and emergency services are struck with ransomware they can often be an indirect victim of another attack caught up in the crossfire. Furthermore, restoration from backups could take weeks which will have a huge knock on effect to people across the country.
Most ransomware attacks come from outside of the country as these are usually done by attackers who hide in countries outside of reach even for international law enforcement agencies. We should not expect ethics and morale from criminals. Putting people’s lives at risk is never justifiable – not by money nor other expected gain.
ESET Ireland 