When the Apology Is the Phish | 2 Minute Drill with Drex DeFord

[00:00] Hey everyone, I'm Drex, and this is the Two Minute Drill.

[00:02] Thanks to Zscaler Healthcare for sponsoring today's show.

[00:05] It's great to see you today.

[00:07] Here's some stuff you might wanna know about.

[00:09] So this story kicks off at about,

[00:12] on Monday, October 26th at about 11 in the morning

[00:16] in Albuquerque.

[00:17] The IT team at the University of New Mexico

[00:20] Health Science Center spot a cyber event unfolding

[00:24] and they start containment.

[00:26] By around 1230, ambulances are being turned away

[00:29] from UNM hospital.

[00:31] That's New Mexico's only level one trauma center.

[00:34] It's also the state's only burn unit

[00:36] and it's also the state's only children's hospital.

[00:40] For about two hours, the most seriously injured people

[00:43] in the state have to go somewhere else.

[00:46] Outpatient surgeries and appointments,

[00:48] all those things are canceled for that day.

[00:51] And that evening, a brand new ransomware gang

[00:54] claims the attack.

[00:55] They call themselves BYOD, BYOD,

[00:58] like bring your own device.

[01:01] Bill Tulis at Bleeping Computer found the post

[01:04] on BYOD's data leak site.

[01:07] BYOD claims they took out 36,000 systems,

[01:11] active directory, the entire Microsoft intra tenant

[01:15] and they claimed they walked away with social security

[01:17] numbers and payroll and patient information

[01:20] and Cerner EHR rosters and maybe some other stuff.

[01:25] In BYOD's own words, quote,

[01:27] this is your entire network and infrastructure compromised,

[01:31] the entire university completely.

[01:34] The English may feel a little broken

[01:36] but the message is loud and clear.

[01:39] Now UNM tells their side of the story like this.

[01:42] They say the attack hit some end user devices

[01:45] but did not penetrate core systems or servers.

[01:49] By the 27th, critical systems were coming back online.

[01:53] UNM says it made no concessions.

[01:56] The FBI is investigating.

[01:58] None of BYOD's claims are confirmed at this point.

[02:03] But also on Tuesday, BYOD post again.

[02:08] And it's like something I've never really seen before.

[02:11] They said they were sorry.

[02:12] They said they didn't know that the machines

[02:15] they were attacking were assisting patients in real time.

[02:19] So they're offering the decryption keys for free.

[02:22] Hospital sector only.

[02:23] And then they say, quote,

[02:25] to any patient that was affected,

[02:28] please provide us proof and we will pay you up to $2,500

[02:31] each for the inconvenience.

[02:33] We're sorry once again.

[02:35] We have morals and we have a heart

[02:37] and we're not the villains, end quote.

[02:39] And tucked right into that apology by the way

[02:42] was also a line that said

[02:44] we are still going to keep the data.

[02:47] So the hackers said they were sorry

[02:50] but they're still going to hold on

[02:52] to all the data that they've stolen.

[02:54] Now, Cyberthud crews have apologized before.

[02:58] Lockbit apologized to Toronto Sick Kids Hospital

[03:02] back in 2023 over a cyber attack that they were involved in.

[03:06] But offering cash directly to patients,

[03:09] that's a whole new thing.

[03:10] And if you read the offer again,

[03:12] it says patients will have to provide us proof.

[03:17] Feel free to contact us on Session,

[03:20] which is an encrypted messaging app.

[03:22] Now the paranoid guy in me says

[03:24] that's really just the phishing message.

[03:26] The criminals already have whatever it is that they took.

[03:30] What they don't have is the patient online

[03:33] volunteering proof of who they are

[03:36] and where they were treated

[03:37] and in order to get paid maybe even access to a bank account.

[03:42] And UNM thankfully picked up on this very quickly

[03:46] and followed up on this potential scam very quickly.

[03:50] By Wednesday, they were telling patients and staff,

[03:52] don't respond to these messages.

[03:55] Don't click, don't send personal or financial information

[03:59] and report any contact you have with these cyberthugs

[04:03] to the FBI at ic3.gov.

[04:08] So here's what we know, something happened

[04:11] and we'll eventually get the whole story.

[04:13] But what seems clear is that UNM has now moved

[04:17] into the recovery phase.

[04:19] So health systems and CIOs and CISOs,

[04:22] we plan for these outages all the time,

[04:24] downtime procedures, business continuity procedures,

[04:27] paper processes, diversions.

[04:30] What we often don't plan for are the week

[04:34] or the weeks after the attack when the attackers

[04:37] or the copycats start to contact the patients

[04:43] directly, they're offering fake refunds

[04:46] or fake compensation or they're making fake calls

[04:49] from the billing office to those patients.

[04:52] Your patients trust your name.

[04:56] After the outage, that trust is usually the next target

[05:00] for these kinds of cyberthugs.

[05:02] So here's today's questions.

[05:04] If you get hit tomorrow,

[05:06] is your patient scam warning process already written

[05:10] and approved and ready to post on day one

[05:13] or will legal and the comms team still be wordsmithing

[05:17] something on day number four?

[05:20] Who owns patient communications during a cyber incident?

[05:25] And do they know that they own patient communications

[05:29] during a cyber incident?

[05:30] Because a lot of times they don't.

[05:32] And when a patient calls and says,

[05:34] the hackers offered me money, should I take it?

[05:37] What will the person who answers your phone say?

[05:41] Open book test, start preparing now.

[05:45] That's it for today's two minute drill.

[05:46] Thanks Skin Disease Scaler Healthcare

[05:48] for sponsoring today's podcast.

[05:50] Drop me a note.

[05:51] Let me know what you're working on.

[05:52] I'm always happy to hear from you.

[05:53] I'm Drex at 229project.com.

[05:57] Thanks for being here.

[05:58] Stay a little paranoid and I will see you around campus.