CasesS=1:500S=1:100
Handa Hospital ransomware attack: the way in and timeline
A VPN appliance installed for vendors' remote maintenance was left unpatched, and its login details had already been published on the internet.
1 Summary
Before dawn on October 31, 2021, printers across the hospital began printing a statement that its data had been stolen and encrypted, and the electronic medical records stopped working. The hospital stopped accepting emergency and new patients. Normal care resumed on January 4, 2022. The expert panel concluded that the attacker most likely came in through the VPN appliance that vendors used for remote maintenance.
Probable cause: A VPN appliance installed for vendors' remote maintenance was left unpatched, and its login details had already been published on the internet.
Source: Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38)
S=1:100 2 Factual information
2.1 The way in
The expert panel: the attacker "is thought to have entered by exploiting a vulnerability in the virtual private network (VPN) device" the hospital had installed, and "it is reasonable to regard the VPN device as the entry route."
Source: Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38)
- Product
- Fortinet FortiGate (VPN appliance for remote maintenance)
- CVE
- CVE-2018-13379
2.2 After entry
Remote Desktop activity was already recorded at 23:57 on October 30, before anyone noticed. Active Directory allowed five-character passwords with no lockout, the built-in Administrator password was the same on every PC, and antivirus had been turned off so the medical-record system would run smoothly. 40 terminals were affected. Backup data from 2018 onward was deleted; offline backups up to 2018 survived.
2.3 Damage
Emergency and new-patient intake stopped and surgery was postponed; the hospital ran on paper under its business-continuity plan. Normal care resumed on January 4, 2022, about two months later. No ransom was paid. The report gives no cost figure.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| 2021-10-30 23:57 | Intruder | Remote Desktop activity on a hospital system, found later in the investigation. | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| 2021-10-31 | Hospital | Before dawn, several printers print a statement that data has been stolen and encrypted. | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| 2021-10-31 00:30 | Hospital | Fault in the electronic medical records confirmed; system staff called. | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| 2021-10-31 03:00 | Hospital | System staff cut the medical-record network. | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| 2021-10-31 08:00 | Hospital | Ransomware infection confirmed. | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| 2021-10-31 08:55 | Hospital | Consults Tokushima Prefectural Police; damage report accepted. | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| 2021-10-31 10:00 | Hospital | Disaster headquarters set up; care continues on paper under the business-continuity plan. | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| 2021-11-03 15:00 | Maintenance vendor (A) | Firmware of the FortiGate VPN updated without regard to preserving logs. | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| 2022-01-04 | Hospital | Medical-record system back; normal care resumes. | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| 2022-06-07 | Expert panel | Investigation report submitted. | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| CVE-2018-13379 had not been fixed on the VPN appliance. | Stated | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| The September 2021 dump of credentials for about 87,000 FortiGate devices contained the hospital's global IP address, ID and password. | Stated | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| No source-IP restriction was set, so any system on the internet could connect. | Stated | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| Entry through the VPN appliance. Logs and evidence did not survive, so this is the panel's reasoned conclusion, reached after weighing phishing, exposed RDP and insiders. | Presumed | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
| When the attacker first got in. | Unknown | Tsurugi Town Handa Hospital, expert panel on the computer virus incident |
S=1:100 4 Conclusions
The panel concluded that the attacker most likely entered through the vulnerability in the hospital's VPN appliance, used its leaked administrator credentials, and spread inside a network where passwords were shared and protections had been turned off. It also found that vendors had not told the hospital about the VPN vulnerability.
S=1:100 5 Recommendations
Recommended or carried out by: Expert panel
- Manage vulnerabilities on network devices, including the VPN appliance.
- Restrict which source IP addresses may connect to the maintenance VPN and the management interface.
- Keep backups offline and off site.
- Give users only the rights they need, and harden Active Directory.
- Choose vendors that share security information, and make that duty explicit.
Source: Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書 技術編」 (printed pp.9–11, 14–15; pp.10–14)Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38)
Sources
Source: Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38)Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書 技術編」 (printed pp.9–11, 14–15; pp.10–14)