FBI, Multi-State Information Sharing and Analysis Center and Cybersecurity and Infrastructure Security Agency warn about Rhysida group's ransomware attacks on hospitals, education, IT, government, and manufacturing sites worldwide

The FBI, Cybersecurity and Infrastructure Security Agency, and Multi-State Information Sharing and Analysis Center Nov. 15 issued a warning about Rhysida, a ransomware-as-a-service group that has predominantly deployed its ransomware variant since May against the health care, education, manufacturing, information technology and government sectors. The group targets victims around the world and publishes stolen files online. The organizations say hospitals are among the group’s “targets of opportunity” for high-impact ransomware attacks, resulting in significant disruptions and delays to health care delivery.

“When hospitals are attacked, lives are threatened,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “Let's be clear: ransomware attacks against hospitals are not financial crimes; they are acts of cyber terrorism and threat-to-life crimes. We encourage the U.S. government and our allies to continue to use their combined capabilities to respond as such, with offensive cyber operations against these cyber terrorists. We in health care need to do our part to defend against these attacks by following the recommended mitigation strategies and enhancing our resiliency against these attacks. Preparing clinical downtime procedures to sustain a loss of technology and communications for up to 30 days will assist in mitigating the impacts to patient care and safety.”