In 2021, the Federal Bureau of Investigation (FBI) aided Boston Children’s Hospital counter a cyberattack conducted by Iranian state-sponsored hackers and prevented any damage. FBI Director, Christopher Wray referred to the attempted cyberattack as a despicable cyberattack.
At the Boston Conference on Cyber Security, Director Wray stated Iranian state-sponsored attackers exploited a vulnerability present in a well-known software solution created by the Californian cybersecurity seller Fortinet. The FBI was informed about the breach and the impending attack by one more intelligence company and informed the hospital on August 3, 2021. Wray mentioned that the FBI connected with the hospital representatives and offered information that allowed the hospital to determine and offset the threat.
Wray mentioned this was an excellent instance of why they work in the field enabling that kind of quick, before-catastrophe-hits response, and mentioned that the incident serves to remind all healthcare providers to make sure they have an incident response strategy that engages the FBI. Wray stated this incident shows the danger of the strong effect of cyberattacks by nation-state threat actors from Iran, Russia, China, and North Korea. He also mentioned they must not let up on Iran or China or criminal syndicates though they were focused on Russia.
Last November 2021, the Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, the Australian Cyber Security Centre (ACSC) and the National Cyber Security Centre (NCSC) in the UK, released a security advisory warning the healthcare industry and operators of critical infrastructure regarding an Iranian nation-state Advanced Persistent Threat actor who has been exploiting Microsoft Exchange and Fortinet vulnerabilities to steal information, perform ransomware attacks and extort cash from victims.
Wray didn’t indicate what kind of attack the threat actor was attempting to conduct, just that a cyberattack may have impaired the network, which may have had a damaging effect on the sick youngsters that depend on it. The said cyberattack seems like done via an HVAC vendor.
In August 2021, a threat actor called Databreaches.net and shared evidence of a successful attack on an HVAC supplier and stated that they had broken into the HVAC vendor’s systems and additionally got access to the networks of a children’s hospital. It was established that the HVAC supplier under consideration, gives services to the Harvard-connected hospitals, Brigham & Women’s Hospital, Boston Children’s Hospital, and Mass General Hospital.
Boston Children’s Hospital encountered cyberattacks in 2014. The hospital experienced an attack that interrupted its systems for more than one week. The attacks were carried out to retaliate how the hospital managed the custody battle case of patient Justina Pelletier. The individual liable for that attack was captured and convicted. He was sentenced to 10 years in jail in 2019.