Hackers held patient files at a Battle Creek doctor's office for ransom. The office didn't pay. It closed.
Dr. William Scalf returned from a vacation in April to find chaos in his Battle Creek medical office.
Inside Brookside ENT and Hearing Center, computers were shut down and wouldn't turn on. Years of patient information was lost. And there was one email sent from China asking for $6,500 in exchange for their patient records, schedules and information.
Scalf met with his partner, Dr. John Bizon, who also represents Calhoun, Barry and Ionia counties in the Michigan Senate. They contacted people they knew in the FBI.
The FBI told them they could pay the ransom, Scalf said, but there was no guarantee they would get the information back and there was nothing stopping the hackers from doing this again in the future. They advised the doctors not to pay.
And so Scalf and Bizon didn't.
They shut down their office instead.
Brookside ENT and Hearing Center is just one of thousands of victims of ransomware across the nation. Experts say it's is a problem that is growing and getting more complex by the day.
“It was a nightmare,” Scalf said.
How does this happen?
Ransomware is a type of virus cybercriminals use to block users from accessing their files. The hackers hold the files hostage until a ransom is paid.
However, there is nothing forcing hackers to return a business’s files even when a ransom is paid, said Alex Hamerstone, who leads Governance, Risk Management, and Compliance at TrustedSec, an information security consulting firm outside Cleveland.
And, even if the information is returned initially, there is nothing stopping the hackers from holding the files for ransom again in the future.
“It really leaves you with no options,” Scalf said.
A report by Beazley Breach Briefing, a software insurance agency, said there were more than 3,300 ransomware attacks against U.S. businesses in 2018 and that 71% of those attacks were against small businesses.
“People don’t know that this happens nearly everyday across the country,” Hamerstone said. “I used to send news alerts to my co-workers every time one would happen, but it got to be too much.”
The healthcare industry has seen a rise in ransomware attacks, which Scott Shackleford, cybersecurity program chair at Indiana University, believes is because healthcare providers are often left with no other option than to pay the ransom because people’s lives could be in jeopardy if the information is lost.
“Unfortunately, medical providers might be more likely to pay up," he said. "They have some information that is critically needed, and the hackers know that."Hamerstone said this is a daily problem in the United States.
Local governments at risk
There are many ways cyber criminals can access a business’s files. Pop-up links on shopping websites and email phishing attacks are among the most common.
Scalf believes a secretary at his medical office clicked on a bad link while shopping online.
While many businesses simply block sites with known malware viruses, medical practices require research on the web, Scalf said, "so we can’t really put too many restrictions on it."
Scalf believes the hackers took control of the practice's system during a system-wide restore, which left their files vulnerable for a short period of time.
“They had gotten into our system earlier,” Scalf said. “They were just waiting for the right time to strike.”
Hamerstone said hackers target small businesses because they typically do not have strong protections or technology staff to prevent attacks.
Similarly, local governments have been hit particularly hard because they often have small information technology staffs, he said.
More 20 government entities in Texas were attacked by a coordinated ransomware virus earlier this month.
In April, the Genesee County reported a ransomware attack on their systems, which stalled normal business for several days.
In 2016, the Lansing Board of Water & Light paid a $25,000 ransom to unlock its internal communication system after it was attacked by ransomware. The publicly owned utility's total cost, which included the ransom and technology upgrades to prevent the issue in the future, totaled $2.4 million.
The city of Battle Creek staffs nine people in their Information Technology department, which is large in comparison to other city governments with similar size populations, Hamerstone said.
Sarah VanWormer, the city's director of Information Technology, said ransomware is one of the department's biggest concerns. She said they constantly educate the city officials on online safety and participate in classes that keep their staff up to date on the most recent trends.
“The biggest thing is education,” she said. “Someone has to do something to cause this to happen. If you keep yourself educated, you can prevent it from occurring.”
What can businesses do to prevent this?
There are many precautions businesses can take to prevent ransomware attacks, but Shackleford believes the way to protect data is backing up all information on a hard drive that is unplugged from the server.
"Backup, backup, backup," he said. "That's my best advice."
Scalf said that, if he could do things over, he would've made hard copies of all his files.
Education on recognizing email scams can also help a lot, Shackleford said. He said that one of the ways is by recognizing grammar mistakes and odd email addresses.
"If you come across an email that's from 'slimshady1010' it's probably a scam," he said. "It's important to get into a habit of checking those types of things."
He said that CEOs and high-ranking officials are usually not the targets of these attacks, so it is important to educate everyone in a business.
"They will target the CEO. And the CEO's support group. And their support group as well," he said.
The aftermath at Brookside ENT
Once the decision was made to not send the hackers their offered ransom, Scalf and Bizon still had patients with appointments scheduled that day. They just didn’t have any information on them.
So Scalf sat in his office and fielded each patient one by one. He was up front with them from the start: he had no information on them and no way to track their current appointment.
“Some decided to stay and still have their appointment,” Scalf said. “Some decided that they wanted to go elsewhere.”
He did this until all his patients had received word of what happened.
Hilarie Walters's daughter was supposed to have an appointment the next week at Brookside ENT with Bizon.
She made a call into the office the day before to confirm the location.
The woman who answered the phone said, "'I'm sorry, Hilarie, but we shut down,'" she said. "I said, 'Are you serious?'".
Without any of their patients' information, they couldn't make calls to inform them of the closure, she was told. Which was a disappointment, she said. Knowing earlier would have helped with finding a new doctor.
"I don't understand how they don't have patient information in a different file is all," she said.
In the aftermath of the ransomware attack, Scalf and Bizon, who did not respond to requests to be interviewed for this article, discussed their options. Since both were close to retirement already, they decided to shut the practice down.
All their information was lost, Scalf said, but none of it was released.
“It was a tough decision and experience as a whole,” he said. “It was a good thing it happened this late into our careers.”