HHS Notice: WannaCry Malware Continues to Impact U.S. Healthcare Orgs | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

HHS Notice: WannaCry Malware Continues to Impact U.S. Healthcare Orgs

June 6, 2017
by Heather Landi
| Reprints

In an email cyber notice, the U.S. Department of Health and Human Services (HHS) is warning healthcare provider organizations that there are ongoing impacts to the U.S. healthcare sector from the WannaCry malware.

The Wanna Cry or Wanna Decryptor ransomware virus swept the globe last month and virtually shut down several dozen regional health authorities within the National Health Service of the United Kingdom, while simultaneously impacting the operations of such diverse entities as Spain’s national telephone service, La Telefónica; Germany’s railway system, Deutsche Bahn; automotive plants of the French car manufacturer, Renault; the Russian Interior Ministry; and universities in China and Taiwan.

In its notice sent out as part of Office of the National Coordinator for Health IT (ONC) and the Office for Civil Rights (OCR) list serves, HHS stated that the department is aware of two, large, multi-state hospitals systems in the U.S. that are continuing to face significant challenges to operations because of the WannaCry malware. HHS specifically notes that this not a new WannaCry attack.

“The behaviors that have been reported are typical for environments where the WannaCry scanning virus persists, even though the encryption stage has been blocked by anti-virus, or is not executing,” HHS wrote in the notice.

The virus can persist even on a machine that has been patched, however, the virus will not spread to a patched machine, but the attempt to scan can disrupt Windows operating systems when it executes. The particular effect varies according to the version of Windows on the device, HHS stated.

If a healthcare organization is the victim of a ransomware attack, HHS recommends the following steps:

Contact your FBI Field Office Cyber Task Force (www.fbi.gov/contact-us/field/field-offices) or US Secret Service Electronic Crimes Task Force (www.secretservice.gov/investigation/#field) immediately to report a ransomware event and request assistance. These professionals work with state and local law enforcement and other federal and international partners to pursue cyber criminals globally and to assist victims of cyber-crime.

Please report cyber incidents to the US-CERT (www.us-cert.gov/ncas) and FBI’s Internet Crime Complaint Center (www.ic3.gov).

Additionally, HHS states that if a facility experiences a suspected cyberattack affecting medical devices, those organizations should contact FDA’s 24/7 emergency line at 1-866-300-4374. Reports of impact on multiple devices should be aggregated on a system/facility level.

For further analysis and healthcare-specific indicator sharing, organizations are urged to share these indicators with HHS’ Healthcare Cybersecurity and Communications Integration Center (HCCIC) at HCCIC_RM@hhs.gov .

WannaCry ransomware is a fast-propagating worm which exploits Windows’ Server Message Block version 1 (SMBv1) protocol to move through a network or infect other systems on the Internet. However, according to HHS in its notice, SMBv1 might not be the only vector of infection for WannaCry, so even patched systems could still be infected if the malware is introduced to the system in a different manner.

Furthermore, a newly patched system could have been previously infected, and if so, would still scan for other vulnerable systems and/or encrypt files. “Patching a system is similar to how in physical medicine, a quarantine will prevent an infection from spreading however will not cure the patient who has been quarantined. Reimaging removes the infection in the operating system no matter where the virus is residing,” HHS stated.

The agency also offered tips for how to mitigate the risk of WannaCry infection:

  • Patch vulnerable systems with the update from Microsoft which fixes the SMBv1 vulnerability: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
  • Disable SMBv1 on all devices, across the network and disable it at the firewall if possible. If it is not possible to disable SMBv1, consider the business-impact for quarantining those devices off the network until another solution can be found.
  • See the Tech Support page from Microsoft below for instructions on disabling SMBv1: https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and-windows-server
  • Block port 445 on all firewalls
  • If possible, reimage potentially affected devices to mitigate risk that malware is on the system in the background.
  • Use a reputable anti-virus (AV) product whose definitions are up-to-date to scan all devices in your environment in order to determine if any of them have malware on them that has not yet been identified. Many AV products will automatically clean up infections or potential infections when they are identified.
  • Work with vendors to make sure both the distribution stage and the encryption stage of WannaCry are detected and blocked.
  • Work with vendors or IT support staff to investigate and remediate systems exhibiting network-scanning activity consistent with WannaCry, which could reimaging per the previous bullet point.

 

Get the latest information on Cybersecurity and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More

Topics

News

Report: Aetna, Apple in Talks about Offering Plan Members Apple Watches

Aetna, which already offers the Apple Watch to its employees as part of a wellness program, is now in talks with Apple about pushing the wearable device to the health insurer’s members, according to a report in CNBC.

HIMSS Accepting Nominations for Most Influential Women in Health IT Awards

The Healthcare Information and Management Systems Society (HIMSS) has announced that nominations are now open for the HIMSS Most Influential Women in Health IT Awards.

E-Visits May Have Unintended Consequences for Docs, New Research Finds

Physicians who adopt e-visits often see increases in office visits and phone consultations, a reduction in new patients being seen by providers, and no noticeable improvements in patient health, according to new research.

CMS Provides More Details on Proposal to Eliminate Mandatory Bundled Payment Programs

The Centers for Medicare and Medicaid (CMS) posted a press release Tuesday that provides more details regarding its proposal to change the Comprehensive Care for Joint Replacement Model and cancel the mandatory Episode Payment Models and Cardiac Rehabilitation Incentive payment model.

HHS Awards $105 Million to Community Health Centers for Quality Improvement

The U.S. Department of Health and Human Services (HHS) has awarded nearly $105 million to 1,333 health centers in all U.S. states, territories and the District of Columbia as an investment in quality improvement.

Survey: Healthcare Pros Challenged to Identify, Mitigate Medical Device Security Risks

More than one-third (36 percent) of surveyed professionals in the Internet of Things (IoT)-connected medical device ecosystem say their organizations have experienced a cybersecurity incident in the past year, according to a recent Deloitte poll.