Medusa Ransomware - Attacks Mississippi Hospital and County

What Happened

In a significant cyberattack, the Medusa ransomware gang has claimed responsibility for targeting the University of Mississippi Medical Center (UMMC), the largest hospital in Mississippi. This attack disrupted operations for nine days, forcing healthcare professionals to revert to analog methods for patient care. The hospital, which employs around 10,000 staff and serves as the state’s only Level I trauma center, faced immense challenges during this period. Doctors and nurses had to find innovative ways to manage patient care without access to their usual digital systems.

The attack occurred at the end of February, with the hospital fully reopening on March 2. During this time, the Medusa gang demanded a ransom of $800,000, threatening to leak sensitive data stolen from the hospital by March 20. The FBI and Department of Homeland Security were called in to assist with recovery efforts, highlighting the seriousness of the incident.

Who's Affected

The primary victims of this attack include UMMC and the patients who rely on its services. With its unique offerings, such as the only children’s hospital and organ transplant programs in Mississippi, the disruption posed a significant risk to patient care. Additionally, the attack on Passaic County in New Jersey, which serves nearly 600,000 residents, further illustrates the widespread impact of Medusa's operations. This county also faced a malware attack that compromised phone lines and IT systems across government offices.

Signs of Infection

Indicators of the ransomware attack included the sudden inability of UMMC to access its digital systems, which forced staff to use paper and pen for managing patient care. The hospital had to close all 35 clinic locations, although its emergency departments remained operational. In Passaic County, the malware attack disrupted communication systems, indicating a coordinated effort by the Medusa group to target critical infrastructure.

How to Protect Yourself

Healthcare organizations and municipalities must prioritize cybersecurity to protect against ransomware attacks. Here are some recommended actions:

• Regularly back up data to secure locations to minimize loss during an attack.
• Implement robust security measures, including firewalls and intrusion detection systems.
• Train staff on recognizing phishing attempts and suspicious activities.
• Develop an incident response plan to ensure swift action in the event of a cyberattack.

As the Medusa ransomware gang continues to target critical sectors, vigilance and preparedness are essential to mitigate risks and protect sensitive data.