Ireland’s health service, the HSE, says they are refusing to pay a $20 million ransom demand to the Conti ransomware gang after the hackers encrypted computers and disrupted health care in the country.
Ireland's Health Service Executive (HSE), the country's publicly funded healthcare system, shut down all of their IT systems on Friday after suffering a Conti ransomware attack.
"We have taken the precaution of shutting down all our IT systems in order to protect them from this attack and to allow us fully assess the situation with our own security partners," the Irish national health service said.
This IT outage has led to widespread disruption in the country's healthcare, causing limited access to diagnostics and medical records, transcription errors due to handwritten notes, and slow response times to healthcare visits.
Hackers demand a $20 million ransom
Yesterday, a cybersecurity researcher shared a screenshot of a chat between Conti and Ireland's HSE with BleepingComputer.
In the screenshot, the Conti gang claims to have had access to the HSE network for two weeks. During this time, they claim to have stolen 700 GB of unencrypted files from the HSE, including patient info and employee info, contracts, financial statements, payroll, and more.
Conti further stated that they would provide a decryptor and delete the stolen data if a ransom of $19,999,000 is paid to the threat actors.
BleepingComputer was also told that the threat actors shared a sample of stolen documents in the chat. However, BleepingComputer did not receive these documents and cannot confirm if they contain legitimate data belonging to the HSE.
In a press statement yesterday, Taoiseach Micheál Martin, the Prime Minister of Ireland, said that they would not be paying any ransom.
'We're very clear we will not be paying any ransom or engaging in any of that sort of stuff' Taoiseach @MichealMartinTD says of the ransomware attack on the HSE | Live blog: https://t.co/itscpwqdS7 pic.twitter.com/Pl4A4JNOST
— RTÉ News (@rtenews) May 14, 2021
Who are Conti?
The Conti ransomware operation is believed to be run by a Russia-based cybercrime group known as Wizard Spider.
This group uses phishing attacks to install the TrickBot and BazarLoader trojans that provide remote access to the infected machines.
Using this remote access, the threat actors spread laterally through a network while stealing credentials and harvesting unencrypted data stored on workstations and servers.
Once the hackers have stolen everything of value and gained access to Windows domain credentials, they wait for a quiet time during the week and deploy the ransomware on the network to encrypt all of its devices.
The Conti gang then uses the stolen data as leverage to force a victim into paying a ransom by threatening to release it on their ransom data leak site if they are not paid.
Other high-profile ransomware attacks conducted by Conti in the past include FreePBX developer Sangoma, IoT chip maker Advantech, Broward County Public Schools (BCPS), and the Scottish Environment Protection Agency (SEPA).
Comments
170fin - 2 years ago
This is endangering lives.
These mofos need to be dealt with in a severe fashion - 40-year sentences or some such - I don't agree with drone attacks but if it was known, unequivocally (therein lies one of the problems with drone attacks - no due process) then I wouldn't lose sleep taking these POS out.
To attack a health service is dispicable. Subhumans!
TsVk! - 2 years ago
As with almost all ransomware operators they are in Russia... the Motherland doesn't really care as long as they aren't attacking their own people. That complicates things.
170fin - 2 years ago
So I believe. Apparently, such attacks are coded to avoid computers using Russian keyboard layouts and such.
Regardless, the Russian ambassador needs to called in to answer what they are doing about this - pressure needs to be brought for them to bear.
TsVk! - 2 years ago
Yes you're right, it's starting. Sanctions are being implemented in the last couple of months and the heat will slowly be turned up. Hopefully not "frog in a pot" slow though or the effect will be lost. Someone that side needs to get the message and do something.
With all the ransomware groups stepping back a bit I think they are realising they may have crossed the line. Just what will come of it we will see.
wkikiwawa - 2 years ago
Russian bred and backed criminal organisations are getting more numerous by the year. The Russian gov doesn't give a damn so long as they attack other nations. Causing pain, humiliation and suffering to others is fun to them. Conscience, remorse or guilt is something they critically lack. Why must we put up with these pathological sociopaths? I imagine the problem will become so cronic something rather drastic will be needed very soon.