Missouri-based Cass Regional Medical Center brought its EHR system back online on Monday, one week after it was hit by a ransomware attack.

Hackers got into the system around 11 a.m. on July 9. Officials promptly shut down its EHR to prevent further damage or access. The health system maintained patient care during the attack but chose to divert trauma and stroke victims to ensure they received the best care.

Cass Regional initiated its prepared incident response just 30 minutes after discovering the attack, which allowed officials to maintain care.

Officials quickly launched an investigation with the help of a third-party vendor, which determined the hackers performed a brute force attack on its remote desktop protocol (RDP) to infect the system with the ransomware. The notice did not mention how much the hackers demanded in ransom.

While officials did not confirm the type of ransomware used, brute force attacks on RDP are used by the notorious SamSam ransomware variant. SamSam was responsible for shutting down Allscripts for about a week in January.

RDP is widely used to give remote access for legitimate business purposes. However, a hacker can use the port to jam ransomware into a network. The trial-and-error method attempts to decode encrypted passwords or other encryption keys using brute force.

[Also: The biggest healthcare data breaches of 2018 (so far)]

While RDP is a legitimate port, a lack of robust security, including unsophisticated logins and passwords, make RDP a vulnerability. In fact, a brute force attack is hard to execute when an organization has multi-factor authentication implemented on its system.

Since the attack, officials said they’ve modified their systems to eliminate the risk.

Other healthcare organizations can shore up RDP vulnerabilities by implementing stronger security controls. That includes adding antivirus on all endpoints, including servers and RDPs, according to CynergisTek Executive Vice President of Strategic Innovation David Finn.

“It needs to be on all of your endpoints,” Finn said. “We sometimes forget about those servers being endpoints.”

Further, organizations can make sure to close ports that don’t need to be opened, and make sure that all public-facing access points are only open to those who need access.

Twitter: @JF_Davis_
Email the writer: jessica.davis@himssmedia.com