<story><title>Oregon hospital shuts down computer system after ransomware attack</title><url>https://www.beckershospitalreview.com/cybersecurity/oregon-hospital-shuts-down-computer-system-after-ransomware-attack-4-notes.html</url></story><parent_chain><item><author>DyslexicAtheist</author><text>Within the past 24 hours at least 5 ransomware attacks[0][1] happened on US hospitals.&lt;p&gt;Apart from timing, the attacks don&amp;#x27;t seem to originate from the same source (which is leading speculation about potential coordination and premature attribution - at least in my social media bubble).&lt;p&gt;&amp;quot;It would be the season to launch politically motivated attacks (so close to election)&amp;quot; is a weak argument because:&lt;p&gt;It&amp;#x27;s a war crime to attack hospitals and the risks of escalation for nation state actors are not aligned with their incentives.&lt;p&gt;Assuming it&amp;#x27;s only financially motivated (crime groups) but with coordination (because timing): Very unlikely because criminal gangs lend themselves poorly to orchestration &amp;#x2F; coordination.&lt;p&gt;A combination of political+criminal (local political actor financing crime groups)? Occam&amp;#x27;s razor cuts deep here.&lt;p&gt;Assume the human brain primed to recognize patterns is a weakness and apply Hanlon&amp;#x27;s razor. Then the &amp;quot;Timing&amp;quot; is just coincidence and cause is horrible healthcare IT.&lt;p&gt;The combination of the pandemic, a politically charged climate (elections), technical-debt in healthcare, premature cyber-attribution, could create a perfect storm.&lt;p&gt;The real lede buried among social media cyber fear-mongering: Discussion wouldn&amp;#x27;t take place if systems had been patched.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nitter.net&amp;#x2F;uuallan&amp;#x2F;status&amp;#x2F;1321477875648942086&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nitter.net&amp;#x2F;uuallan&amp;#x2F;status&amp;#x2F;1321477875648942086&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nitter.net&amp;#x2F;ColdHandsMD&amp;#x2F;status&amp;#x2F;1321227783968796674&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nitter.net&amp;#x2F;ColdHandsMD&amp;#x2F;status&amp;#x2F;1321227783968796674&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;whitequark&amp;#x2F;status&amp;#x2F;1321625126841032705&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;whitequark&amp;#x2F;status&amp;#x2F;1321625126841032705&lt;/a&gt;&lt;p&gt;see also CISA advisory (pdf) &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;us-cert.cisa.gov&amp;#x2F;sites&amp;#x2F;default&amp;#x2F;files&amp;#x2F;publications&amp;#x2F;AA20-302A_Ransomware%20_Activity_Targeting_the_Healthcare_and_Public_Health_Sector.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;us-cert.cisa.gov&amp;#x2F;sites&amp;#x2F;default&amp;#x2F;files&amp;#x2F;publications&amp;#x2F;AA...&lt;/a&gt;</text></item></parent_chain><comment><author>jkilpatr</author><text>&amp;gt; It&amp;#x27;s a war crime to attack hospitals and the risks of escalation for nation state actors are not aligned with their incentives.&lt;p&gt;The primary point of nation-state cybercrime is that individual citizens have not yet established at any large scale if they would support a physical response to a cyber attack.&lt;p&gt;If you have a physical attack political leadership can be pretty sure the people will support them in retaliating.&lt;p&gt;But with cybercrime, without big pictures on the TV of death and destruction that support does not seem to exist. Combine this with an opposing party willing to capitalize on public doubt and inaction is a political certainty.</text></comment>
<story><title>Oregon hospital shuts down computer system after ransomware attack</title><url>https://www.beckershospitalreview.com/cybersecurity/oregon-hospital-shuts-down-computer-system-after-ransomware-attack-4-notes.html</url></story><parent_chain><item><author>DyslexicAtheist</author><text>Within the past 24 hours at least 5 ransomware attacks[0][1] happened on US hospitals.&lt;p&gt;Apart from timing, the attacks don&amp;#x27;t seem to originate from the same source (which is leading speculation about potential coordination and premature attribution - at least in my social media bubble).&lt;p&gt;&amp;quot;It would be the season to launch politically motivated attacks (so close to election)&amp;quot; is a weak argument because:&lt;p&gt;It&amp;#x27;s a war crime to attack hospitals and the risks of escalation for nation state actors are not aligned with their incentives.&lt;p&gt;Assuming it&amp;#x27;s only financially motivated (crime groups) but with coordination (because timing): Very unlikely because criminal gangs lend themselves poorly to orchestration &amp;#x2F; coordination.&lt;p&gt;A combination of political+criminal (local political actor financing crime groups)? Occam&amp;#x27;s razor cuts deep here.&lt;p&gt;Assume the human brain primed to recognize patterns is a weakness and apply Hanlon&amp;#x27;s razor. Then the &amp;quot;Timing&amp;quot; is just coincidence and cause is horrible healthcare IT.&lt;p&gt;The combination of the pandemic, a politically charged climate (elections), technical-debt in healthcare, premature cyber-attribution, could create a perfect storm.&lt;p&gt;The real lede buried among social media cyber fear-mongering: Discussion wouldn&amp;#x27;t take place if systems had been patched.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nitter.net&amp;#x2F;uuallan&amp;#x2F;status&amp;#x2F;1321477875648942086&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nitter.net&amp;#x2F;uuallan&amp;#x2F;status&amp;#x2F;1321477875648942086&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nitter.net&amp;#x2F;ColdHandsMD&amp;#x2F;status&amp;#x2F;1321227783968796674&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nitter.net&amp;#x2F;ColdHandsMD&amp;#x2F;status&amp;#x2F;1321227783968796674&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;whitequark&amp;#x2F;status&amp;#x2F;1321625126841032705&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;whitequark&amp;#x2F;status&amp;#x2F;1321625126841032705&lt;/a&gt;&lt;p&gt;see also CISA advisory (pdf) &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;us-cert.cisa.gov&amp;#x2F;sites&amp;#x2F;default&amp;#x2F;files&amp;#x2F;publications&amp;#x2F;AA20-302A_Ransomware%20_Activity_Targeting_the_Healthcare_and_Public_Health_Sector.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;us-cert.cisa.gov&amp;#x2F;sites&amp;#x2F;default&amp;#x2F;files&amp;#x2F;publications&amp;#x2F;AA...&lt;/a&gt;</text></item></parent_chain><comment><author>simias</author><text>Do all 5 attacks share some common vector? If so it could be that some zero-day or vulnerable target list has been shared within the past few days on some seedy underbelly of the darknet and a few opportunists decided to act on it?</text></comment>