Ransomware attack: Diverting personnel, seeking DRDO’s help, AIIMS tries to control damage

A notice outside the Blood Bank in AIIMS, New Delhi.

Grappling with complete shutdown of the e-hospital system, the All India Institute of Medical Sciences (AIIMS) in the national capital has now diverted nearly 250 personnel attached with doctors in research projects to work on patient services, all of which is being done manually.

A major ransomware attack that hit the leading teaching hospital last week has made centralised records inaccessible and has affected hospital services such as generation of unique health identification numbers, new registrations, laboratory reports, the process of billing and patient discharge, among others.

The institute, which sees nearly 25,000 patients in the outpatient department every day, has been able to provide consultation services to just about one-fifth that number since November 23, when the cyberattack took place.
Beginning Tuesday, the hospital—after diverting the services of research assistants for clinical works—has managed to shorten the queues of waiting patients in most departments to some extent.

“Our effort has been not to return any patient without delivering requisite services,” insisted the head of a key department in the hospital who did not want to be named.
Sources in the administrative department of the institute also said that help has been sought from the Defence Research and Development Organisation for at least four new servers that can be used to restore digital services.

A team of experts from the Indian Computer Emergency Response Team (CERT-in) and National Informatics Centre (NIC) are already working on restoring online services, authorities maintained.

Old patients, lab reports worst hit

On Wednesday morning, Sandhya Rani, 34, from Bihar, stood outside the paediatric OPD wearing a forlorn look. She had last come to consult for her 7-year-old daughter who is suffering from an impaired liver.

Also read | Analysis shows shocking rise in lung cancer cases among youth, non-smokers and women

“On November 21, my daughter got an ultrasound done and the report was expected on Monday, which I needed to show to the doctor,” she said. “But for the last three days, I am being told the same thing, that the server is down and reports are not getting generated, and without the report the doctor cannot see my child,” Rani said.

Nisha, a patient coordinator in the department, said that while reports of tests such as electrocardiogram and X-rays are being managed manually, tests such as ultrasound and magnetic resonance imaging (MRI) are suspended.
“Many blood tests are also not being offered at the moment,” she said.

A staffer at the billing counter in the cardiology department said that old patients were having a harrowing time as the hospital and treating doctors could not retrieve their past medical records.

Insiders said that in the attack, detailed health data related to nearly four crore patients may have been compromised.

Impact on academics too

One of the prime reasons why the institute is considered so prestigious is because of the quality of teaching and the research work carried out here. The latest incident has dented these two as well.

Many doctors who spoke off the record pointed out that they are unable to retrieve e-library or use other websites, which is halting academic work.

“For the last one week, the functioning of the faculty is badly affected as we cannot access patients’ records for analysis or for teaching students,” said a senior faculty member in the neurosciences department. “I greatly fear that a large amount of data including case histories and studies may not be available even if new servers are brought in.”

The hospital administration refused to comment on Wednesday when Moneycontrol tried to reach them with these concerns but on Tuesday, in a brief statement, it said that it had recovered all its data but “all hospital services, including outpatient, inpatient, laboratories, etc, continue to run on manual mode”.

“The eHospital data has been restored on the servers,” said the statement. “Network is being sanitised before the services can be restored. The process is taking some time due to the volume of data and large number of servers/computers for the hospital services.”

‘Most serious attack’

The hospital so far has given no details about the nature of the cybersecurity incident and has refuted local media reports that the hackers had demanded a ransom of Rs 200 crore for restoring the servers but the first information report (FIR) lodged in the case has also mentioned extortion.

Also read | Analysis | Kerala panel suggests rabies vaccines for kids across India but is that practical?
Noted cyber expert Pavan Duggal called it the most serious cyberattack in the history of independent India and pointed out that sensitive personal data related to crores of Indians including a large number of bureaucrats, politicians and ministers is now with cybercriminals and can be misused.
“The fact that digital service in such a premier health institute in the country has been crippled for nearly a week shows that there is no data backup and that is very unfortunate,” he said.
Duggal said that the episode should push authorities in India to bring a dedicated legislation targeted at strengthening cybersecurity.

“The European Union now has a Cyber Resilience Act and we should quickly have a strong legal framework on similar lines and the Information Technology Act, 2000, does not address aspects related to cybersecurity at all,” he pointed out.

Duggal also said even if a ransom of Rs 200 crore, as reportedly demanded by the hackers, is paid, there is no guarantee that the stolen data would not reach the dark web and not be used for cybercrimes in the future.