A sophisticated ransomware group has launched a coordinated attack against hospital networks across Europe, encrypting patient records and demanding millions.
A newly identified ransomware strain dubbed MedLock has been used in coordinated attacks against at least 12 hospital networks across Europe. The attacks have encrypted patient records, disrupted medical equipment, and forced several hospitals to revert to manual paper-based operations.
The ransomware operators are demanding payments ranging from 2 million to 8 million dollars per institution. Security researchers believe the group behind the attacks has ties to a previously known Eastern European cybercriminal organization.
Healthcare organizations are being advised to immediately audit their network segmentation, ensure offline backups are current, and review remote access security. The FBI and Europol are coordinating an international response to the attacks.
Several hospitals have already paid ransoms to restore access to patient data, raising concerns about funding future criminal operations. Law enforcement agencies strongly advise against paying ransoms as it encourages further attacks.
The MedLock ransomware uses advanced evasion techniques to avoid detection by standard antivirus software and encrypts files using military-grade AES-256 encryption.