A health center's ransomware attack through a former IT vendor's admin login (2021) and what it shows about vendor accounts

A community health center in New York was hit by ransomware (malware that scrambles files so they can’t be used, then demands a ransom) in 2021. The New York Attorney General found that the attackers got onto its network with the login for an admin account an IT vendor had used. The vendor had stopped working for the center years earlier. The findings and the settlement are in an Assurance of Discontinuance (a written settlement with the attorney general) that took effect December 29, 2023. The office announced it on January 5, 2024. The center neither admits nor denies the findings.

What happened

In late May 2021, attackers first got into a system the center used to view video from its internal cameras. A static four-digit code was the only protection on that system.

From there, the attackers reached the center’s private network remotely. They used login details for an administrative account that, according to the record, were stolen during the attack. The record doesn’t say how they were stolen. It was one of the center’s own accounts, used by a former IT vendor. The vendor hadn’t worked with the center since 2014, yet the account had never been deleted or disabled. Its password hadn’t changed for at least 11 years, and multi-factor authentication (MFA: a second check beyond the password, such as a code from a phone app) wasn’t turned on.

Inside the network, the attackers could reach shared network folders, employee email and a database used by the center’s dental practice. Over two days they copied out files with patient information. They also used ransomware to lock several systems. The center found the attack on June 1, 2021. By then about a terabyte of data had left. The center couldn’t tell which files were taken. It had no systems logging that activity, and traces that might have shown it were lost when systems were rebuilt to shut the attackers out.

The center later found that the files reached held information on more than 260,740 patients. Of those, 175,077 lived in New York. It began notifying patients on April 29, 2022. During the attorney general’s investigation, the center found that the dental database alone held data on roughly 195,974 to 233,575 patients. About 72,000 to 79,000 of the New York residents in it had not been notified.

What the attorney general found

A vendor had done a HIPAA risk assessment for the center in March 2017, and several issues it found were still open when the attack came. The attorney general listed gaps in the center’s security program at the time. It names four gaps in access controls. The center didn’t shut down inactive user accounts, didn’t change account passwords on a regular basis, didn’t use MFA, and didn’t limit employees to the data their jobs needed. It also didn’t encrypt stored patient data or record and review user activity on its network.

The office found violations of the HIPAA Security Rule. They include the sections on password management (164.308(a)(5)(ii)(D)), audit controls (164.312(b)) and checking that a person is who they claim to be (164.312(d)). It also found violations of New York’s breach notice law, General Business Law 899-aa, and its data security law, 899-bb. The data security law requires a business that owns or licenses New York residents’ private information to keep reasonable safeguards.

What the agreement requires

The center pays $450,000 in penalties and costs. Of that, $100,000 is suspended. It becomes due if the center doesn’t spend $1.2 million on its security program between fiscal years 2024 and 2028. It also becomes due if the office finds material misstatements in the fiscal 2022 financial statement the center gave it.

On access, the center must keep policies that require:

• giving people and organizations access only to what their work needs;
• promptly removing a person’s or organization’s access when they leave;
• MFA for remote access to its resources and data;
• regularly changing the passwords and other login details used to reach them;
• an audit of these rules at least twice a year.

For MFA, password changes and the audit, the agreement accepts an equivalent, widely used measure if the center’s security lead approves and documents it in writing.

The center also had to audit its accounts within 90 days, log and review activity on its systems, encrypt patient data, and get an outside security assessment within a year and then yearly for five more years. The center told the office that it had already added MFA for remote access, among other steps.

Controls usually expected after incidents like this

So the record points at an account that outlived the vendor’s contract, plus a password nobody changed. Federal rules and guidance cover both.

Under the HIPAA Security Rule, 45 CFR 164.312(d) tells you to have procedures that verify whoever seeks access to electronic patient information is the one claimed. Password management, 164.308(a)(5)(ii)(D), is labeled “Addressable.” Under 164.306(d)(3), that means you assess whether it is reasonable and appropriate for you. If it is, you put it in place; if not, you document why and use an equivalent measure where one is reasonable.

CISA’s #StopRansomware Guide is more direct. It asks you to use MFA on all VPN connections (private connections into your network from outside) and to change default admin usernames and passwords. It also says to audit user and admin accounts each quarter for inactive or unauthorized ones, and to include access given to outside IT providers (managed service providers) in that review. And it says outside parties should reach only the devices and servers within their role.

For a step-by-step version of ending a vendor’s access, see taking back access when a vendor contract ends. For vendors who maintain systems remotely, see managing an IT or EHR vendor’s remote access.

Questions to ask about your own setup