In March 2014, Boston Childrens Hospital learned the worst possible security newsfrom a third-party vendor with no formal relationship to the facility.
That vendor told the pediatric facility that it had seen online documents threatening the hospital, as well as posted documents with information on physicians such as cell phone numbers, addresses and work locations. And the information also included details of Boston Childrens infrastructure, such as the main IP address of its organizational web site.
Any kid could find this stuff easily online, but it was clear someone was trying to damage the reputation of Boston Childrens, said Daniel Nigrin, MD, senior vice president and CIO in the division of endocrinology, during the Cybersecurity Forum at HIMSS17.
Then came a video from the activist hacking organization Anonymous, accusing the hospital of having tortured a child. Ive been a CISO for 16 years; this was a new one me, Nigrin recalled.
In particular, the charge from Anonymous centered on a teenage girl that the hospital determined was suffering from malnutrition. The case went to court, where a judges ruling removed the child from parental custody. The family fought the decision, and the controversy found its way to Anonymous, which decided that Boston Childrens needed to be taught a lesson.
We wondered if it was the real Anonymous; thankfully, the decision was to take the threat seriously, Nigrin said. The hospital convened an incident response team and starting forming contingency plans for an expected attack, which included going dark and cutting itself off from the Internet while assessing the systems and processes still necessary to keep the facility running.
Also See: Many organizations lack direction on cybersecurity
In the meantime, Boston Childrens contacted local police and the FBI, who were reluctant to step in proactively, and told hospital executives to get back to them if anything happened. Three weeks went by without incident, and the facility was hit with low-value distributed denial of service attacks that were handled. But then, tactics started to change as attacks increased in volume.
One week later on a Saturday night, the cat-and-mouse game ended with a dramatic uptick in attacks and a third party was engaged to help the hospital defend itself. The concerted Anonymous cyber attack started April 14 and ended on April 27. At its peak, the hackers were sending 30-day levels of malicious traffic in very short periods of time.
The teenage patient at the center of the controversy had long since been discharged, but Anonymous was demanding she be sent home, according to Nigrin. The group threatened the hacking of documents of the hospitals staff was coming next, with a HIPAA breach thereafter. Then, Boston Childrens saw a penetration of attacks across all organization web sites and ports, which were shut down, and also saw a massive influx of malware-laden emails100 times more than normaland because of the high volume, that some malware eventually would get through, so it shut down the email system temporarily.
Boston Childrens recontacted local and federal authorities, and this time, they were much more interested in what was happening, and told the hospital not to notify the press. While reporters were calling for information, the hospital was not responding. It didnt matter; reporters already knew. The top story in the next days Boston Globe read, Cyberattack Hits Childrens Hospital.
The hospital wasnt the only organization being attacked; an energy company that had sponsored an annual walkathon also was hit and advised to stop helping Boston Childrens. Then, within 36 hours, the attacks subsided. Boston Childrens gradually brought external facing web sites back on line after expensive penetration testing from a third-party vendor.
Before the attacks, Nigrin did not think a childrens hospital would be targeted, so you cannot assume you are above this, he warned colleagues. We were fortunate to have a three-week period to prepare.
In the current cyber environment, CISOs need to be much more aggressive, he asserted. You need to push through security measurestheres no excuses anymore. Were beyond allowing ourselves to get pushed by that pushback. Focus on the pain and millions of dollars that can be spend to end an organizational incident. I urge you to use this experience as a burning platform. If your organization is not paying attention, scream louder and ask them to talk to me.
Also See: 6 top IT security for 2017
The FBI later told Boston Childrens to pay attention to its audio-video conferencing systems, after the FBI itself was hacked by Anonymousthe group had been on calls and published transcripts, because the FBI calls had not been secure, Nigrin said.
After the attack, Boston Childrens conducted a round of security re-education and urged employees to be more observant. Soon after, that training was put to the test as the hospital was hit by phone phishing efforts.
The hospital had cyber insurance in place, but had to fight for coverage because the insurer contended what while there was an attack there was no breach. We argued that if we had not done what we did, we would have had a massive data breach, Nigrin said.
See more here:
Anatomy of a cyber attack explained at HIMSS17 - Health Data Management
- Anatomy of a Fly - SIFF 2009 Fly Documentary - Video - January 14th, 2013 [January 14th, 2013]
- Grey's Anatomy Sneak Peek 9.11 - The End is the Beginning is the End (6) - Video - January 15th, 2013 [January 15th, 2013]
- Anatomy of the sangeet! - Video - January 18th, 2013 [January 18th, 2013]
- Go Anatomy for iPad - Video - January 19th, 2013 [January 19th, 2013]
- Grey's Anatomy - Callie and Arizona "We don't have to move yet" 9x16 - Video - February 22nd, 2013 [February 22nd, 2013]
- Imaging of Petrous bone anatomy (Sep 2013) - Dr Mamdouh Mahfouz (In Arabic) - Video - January 14th, 2014 [January 14th, 2014]
- Anatomy in the Yahoo! Directory - January 21st, 2014 [January 21st, 2014]
- Let's Play Minecraft - Episode 87 - Geoff's Anatomy - Video - January 26th, 2014 [January 26th, 2014]
- Cat Anatomy Pg. 25 Lab Notes - Video - February 2nd, 2014 [February 2nd, 2014]
- Spinal Pathways Tracts Part 1 Introduction Anatomy Tutorial - Video - February 9th, 2014 [February 9th, 2014]
- Galway health app firm joins US academy - April 9th, 2014 [April 9th, 2014]
- Greys Anatomy season 10 episode 18 airs tonight: Power through - April 9th, 2014 [April 9th, 2014]
- Greys Anatomy Recap: A Vicious Viral Infection Puts Everyone At Risk - April 9th, 2014 [April 9th, 2014]
- Grey's Anatomy Recap: "You Be Illin'" - April 9th, 2014 [April 9th, 2014]
- Greys Anatomy season 10, episode 19 stills show Cristinas big moment - April 9th, 2014 [April 9th, 2014]
- Review: 'Your Inner Fish' on PBS imparts smart human anatomy lesson - April 9th, 2014 [April 9th, 2014]
- Fantastically Creepy Images and Tales From The Morbid Anatomy Anthology - April 9th, 2014 [April 9th, 2014]
- Step Brothers- Anatomy Movements - Video - April 9th, 2014 [April 9th, 2014]
- Matt Lloyd: Anatomy of a $315k / Month Business - Video - April 9th, 2014 [April 9th, 2014]
- Guitar Anatomy | Minute Music School - Video - April 9th, 2014 [April 9th, 2014]
- Anatomy Mnemonics - Chapter 3 : Nervous System - DoctorKC - Video - April 9th, 2014 [April 9th, 2014]
- Bates Motel: Anatomy of a Scene: Bradley Shoots Gil (S2) - Video - April 9th, 2014 [April 9th, 2014]
- Innovation at Stanford Anatomy - Video - April 9th, 2014 [April 9th, 2014]
- The science of anatomy is undergoing a revival - April 10th, 2014 [April 10th, 2014]
- Grey's Anatomy: Will Alex Really Leave Grey Sloan Memorial? - April 10th, 2014 [April 10th, 2014]
- Greys Anatomy season 10 episode 19 airs tonight: A major award - April 10th, 2014 [April 10th, 2014]
- Anatomy - Wikipedia, the free encyclopedia - April 10th, 2014 [April 10th, 2014]
- anatomy man 3d visual effects - Video - April 10th, 2014 [April 10th, 2014]
- Talk about human anatomy - part 1 - Video - April 10th, 2014 [April 10th, 2014]
- Bootstraps - I Wanna Dance With Somebody - Video - April 10th, 2014 [April 10th, 2014]
- Greys Anatomy Recap: Cristinas Career Hits A Major Milestone - April 15th, 2014 [April 15th, 2014]
- Greys Anatomy season 10, episode 20 stills, synopsis: Trouble in paradise? - April 15th, 2014 [April 15th, 2014]
- Anatomy - New World Encyclopedia - Info:Main Page - New ... - April 15th, 2014 [April 15th, 2014]
- anatomy (biology) -- Encyclopedia Britannica - April 15th, 2014 [April 15th, 2014]
- Jean Sives ITEC Anatomy and Physiology Testimonial - Video - April 15th, 2014 [April 15th, 2014]
- Grey Text Anatomy - Video - April 15th, 2014 [April 15th, 2014]
- The Devil Wears Prada - Anatomy (HD GUITAR COVER) - Video - April 15th, 2014 [April 15th, 2014]
- 'Joe' | Anatomy of a Scene w/ Director David Gordon Green | The New York Times - Video - April 15th, 2014 [April 15th, 2014]
- 'Fame' by Mree (Grey's Anatomy 10x19) - Video - April 15th, 2014 [April 15th, 2014]
- Tessa Ferrer Joins the Cast of Extant! Grey's Anatomy Cast-Off Books New Gig on CBS' Summer Series - Video - April 15th, 2014 [April 15th, 2014]
- Brain anatomy differences between deaf, hearing depend on first language learned - April 15th, 2014 [April 15th, 2014]
- Captain America Winter Soldier | Anatomy of a Movie - Video - April 15th, 2014 [April 15th, 2014]
- Grey's Anatomy After Show Season 1 Episode 13 "I'm Winning" | AfterBuzz TV - Video - April 15th, 2014 [April 15th, 2014]
- Spoiler Chat: Scoop on Grey's Anatomy, Orphan Black, The Mindy Project, The Blacklist and More - April 16th, 2014 [April 16th, 2014]
- Anatomy of a recall - April 16th, 2014 [April 16th, 2014]
- NBME Shelf Exam - Case Files Series App - Anatomy - Video - April 16th, 2014 [April 16th, 2014]
- Radius and ulna - Anatomy tutorial (Preview) | Kenhub - Video - April 16th, 2014 [April 16th, 2014]
- Greys Anatomy Season 10 Spoilers: Finale Teases Traumatic Ending; Will Cristina Yang Be Killed Off In Episode 24? - April 17th, 2014 [April 17th, 2014]
- Greys Anatomy season 10, episode 20 airs tonight: Having faith - April 17th, 2014 [April 17th, 2014]
- (WARNING: CONTAINS SPOILERS) Game of Thrones Season 4: Anatomy of a Scene - The Royal Wedding (HBO) - Video - April 17th, 2014 [April 17th, 2014]
- Heart anatomy - Video - April 17th, 2014 [April 17th, 2014]
- Heart anatomy 3 Left & Right pulmonary veins, ascending aorta, left common carotid - Video - April 17th, 2014 [April 17th, 2014]
- Heart anatomy 2 tricuspid valve, bicuspid valve - Video - April 17th, 2014 [April 17th, 2014]
- Flash Brain Anatomy Review - Video - April 17th, 2014 [April 17th, 2014]
- Anatomy of the 2014 Birdathon - April 18th, 2014 [April 18th, 2014]
- Greys Anatomy Season 10 Spoilers: Episode 23 And 24 Titles Leaked Online; Song-Based Titles Gives Fans Clues Of ... - April 18th, 2014 [April 18th, 2014]
- Greys Anatomy Recap: Does Cristina Yang Win The Harper-Avery Award? - April 18th, 2014 [April 18th, 2014]
- Greys Anatomy season 10, episode 20 recap: Making mistakes - April 18th, 2014 [April 18th, 2014]
- Grey's Anatomy Recap: "Go It Alone" - April 18th, 2014 [April 18th, 2014]
- Greys Anatomy: April & Jackson Need To Make Their Marriage Work - April 18th, 2014 [April 18th, 2014]
- Grey's Anatomy Music Season 10x20 Aron Wright Everybody Wants To Rule The World - Video - April 18th, 2014 [April 18th, 2014]
- Grey's Anatomy Cast - How To Save A Life - Video - April 19th, 2014 [April 19th, 2014]
- ReVamp - The Anatomy Of A Nervous Breakdown: On The Sideline - Philly 2014 - Video - April 19th, 2014 [April 19th, 2014]
- Twisted Mind Anatomy - Don't Run Away EP - Video - April 19th, 2014 [April 19th, 2014]
- Anatomy of a Landscape trailer - Video - April 19th, 2014 [April 19th, 2014]
- Advanced Anatomy - Video - April 19th, 2014 [April 19th, 2014]
- anatomy study - Video - April 21st, 2014 [April 21st, 2014]
- |An anatomy of a Rabbit - Video - April 21st, 2014 [April 21st, 2014]
- Grey's Anatomy 10x21 "Change Of Heart" - Farewell to Cristina - ABC HD promo #1 - Video - April 21st, 2014 [April 21st, 2014]
- Anatomy of Cosplay: LIVE Q&A (with Sam & Mae!) - Video - April 21st, 2014 [April 21st, 2014]
- DJ Tennis - Anatomy (North Lake Remix) - Video - April 21st, 2014 [April 21st, 2014]
- ITEC Anatomy & Physiology Testimonial by Kerry Howard - Video - April 21st, 2014 [April 21st, 2014]
- The anatomy of a sexuality class - April 22nd, 2014 [April 22nd, 2014]
- Human body - Wikipedia, the free encyclopedia - April 22nd, 2014 [April 22nd, 2014]
- 'Fading Gigolo' | Anatomy of a Scene w/ Director John Turturro | The New York Times - Video - April 22nd, 2014 [April 22nd, 2014]
- Guitar Anatomy - Part 1 - Video - April 22nd, 2014 [April 22nd, 2014]
- Anatomy Scan At 19Weeks 3Days - Video - April 22nd, 2014 [April 22nd, 2014]
- Grey's Anatomy After Show Season 10 Episode 20 "Go It Alone" | AfterBuzz TV - Video - April 22nd, 2014 [April 22nd, 2014]
- Grey's Anatomy 10x21 Promo | Grey's Anatomy Season 10 Episode 21 Promo| Grey's Anatomy S10E21 Promo - Video - April 22nd, 2014 [April 22nd, 2014]
- Greys Anatomy Season 10 Spoilers: Cristina Yang To Make A Life Or Death Decision In Episode 21; Who Will She Save ... - April 24th, 2014 [April 24th, 2014]