University Hospital New Jersey was forced to pay $670,000 after a ransomware attack

In September 2020, University Hospital New Jersey (UHNJ) paid about $670,000 to a group of attackers who had stolen and encrypted its data, as Bleeping Computer reported.

More precisely, the hospital was attacked with ransomware called SunCrypt. The attackers stole 240 GB of data, including patient data, and published an archive of 48,000 documents which, they claimed, contained copies of identity documents, dates of birth, Social Security numbers and diagnoses. The attack was a classic one: once inside the network, the attackers stole the data and then encrypted the affected systems.

It all started with a phishing email: an employee gave away their login details, and the attackers used them to connect to the hospital’s Citrix server.

UHNJ had only two servers encrypted, but it paid mainly to keep the patients’ data from being published. The attackers had initially demanded $1.7 million. After several rounds of negotiation, the amount paid was $672,744, in bitcoin (61.90 bitcoin, to be exact), on September 19, 2020.

In exchange for the money, the attackers promised a decryption program, the return of the stolen data, a security report on how they got into the network, and that they wouldn’t publish the data or attack the hospital again. Even so, a company that pays has no guarantee that the data is really deleted.

How do you protect your infrastructure from ransomware attacks?

With layers of protection that stop attackers at every step: at the entrance, inside the network and at the data. Ransomware attacks are every company’s nightmare, because when data gets encrypted, the damage is huge. Fines are also high when personal data is compromised: GDPR provides for fines of up to €20 million or 4% of annual worldwide turnover, whichever is higher. Plus, most of the time, the company’s operations are also seriously affected by the loss of data.

The standard protection measures that prevent this kind of situation are the following:

• a strict security policy: security updates are absolutely mandatory;
• two-step verification (MFA) for any access from outside the network, including Citrix, VPN and email; in UHNJ’s case, the password obtained through phishing wouldn’t have been enough;
• training employees to recognize phishing attacks;
• isolating critical equipment so it can’t be accessed from outside the network; outside access is restricted and allowed only over secure connections;
• centrally managed protection solutions with behavior-based detection (EDR), which can stop a process that starts encrypting files;
• implementing a serious backup policy, with a copy that attackers can’t modify or delete and with tested restores, so data can be restored easily when needed;
• an incident response plan, so the team knows what to do in the first few hours.

You can read about how the groups that rent out ransomware to other attackers operate in the article on RaaS (Ransomware as a Service).

What should a company in Romania do after a ransomware attack?

Isolate the affected systems, notify the authorities within the legal deadlines and restore the data from backup, rather than negotiate with the attackers.

• GDPR: if personal data has been affected, the company notifies ANSPDCP (the Romanian data protection authority) within 72 hours at most of becoming aware of the incident, if it puts people’s rights at risk.
• NIS2: entities in the sectors covered by GEO 155/2024 (the Romanian law transposing NIS2), healthcare among them, report significant incidents to DNSC (Romania’s National Cyber Security Directorate): an early warning within 24 hours, an incident notification within 72 hours and a final report within one month at most.

Hospitals in Romania have been through this too. In February 2024, ransomware from the Phobos family (Backmydata) encrypted the systems of 25 hospitals that used the Hipocrate (HIS) platform, and another 75 were taken offline as a precaution, according to Bleeping Computer. The attackers demanded 3.5 bitcoin. Most of the affected hospitals had backups made 1–3 days earlier, and DNSC strongly recommended that no one pay the ransom.

RezolvIT is an IT outsourcing company that manages infrastructures of varied complexity and size, through its IT security and Backup as a Service services. We also support you with NIS2 compliance.

If we’ve convinced you, request a free IT audit using the contact form.