Clinic Pays Ransom After Backups Encrypted in Attack

A small Missouri clinic admits paying a ransom to unlock data after a ransomware attack in August encrypted patient data on a file server, as well as backups. The incident spotlights the dilemmas healthcare organizations can face after a ransomware attack if they're not well-prepared.

In an Oct. 13 statement, Namaste Health Care in Ashland, Missouri, a clinic with one physician and two other clinicians, reveals that during the weekend of Aug. 12-13, "an unknown cyberattacker gained improper access into Namaste's computer systems and appears to have remotely accessed Namaste's file server."

The cyberattacker "appears to have not only accessed and potentially viewed information contained on that file server but also then launched a ransomware virus/attack on the file share server, which resulted in the encryption of Namaste's data that was housed on that server as of Aug. 14," the clinic says.

Upon learning of the attack on Aug. 14, the clinic says it immediately "disabled the unauthorized user's access and took the computer systems offline, and with the assistance of our IT contractor, we worked to investigate, eliminate and remediate the malware attack on the systems."

The clinic says it "terminated any further remote access permissions pertaining to the system, and we then subsequently paid the cyberattacker's ransom demand in order to obtain the decryption key and restore the encrypted data."