DOJ recovers ransom paid to North Korean hackers targeting health care

The Justice Department has recovered about $500,000 in ransom that a Kansas hospital and Colorado medical provider paid to state-sponsored North Korean hackers, the agency announced yesterday.

“Thanks to rapid reporting and cooperation from a victim, the FBI and Justice Department prosecutors have disrupted the activities of a North Korean state-sponsored group deploying ransomware known as ‘Maui,’” said Deputy Attorney General Lisa O. Monaco yesterday at the International Conference on Cyber Security. “Not only did this allow us to recover their ransom payment as well as a ransom paid by previously unknown victims, but we were also able to identify a previously unidentified ransomware strain.”

Federal agencies this month recommended U.S. health care organizations take certain actions to protect against the Maui ransomware threat.

“The Maui ransomware identification and funds seizure is a great example of how important it is for hospital and health system victims of cyberattacks to engage in timely and active cooperation with the FBI,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “Not only did it assist the individual victims, but it also provided critical pieces of the intelligence ‘puzzle’ for the FBI. This allowed the FBI to inflict some consequences on the Maui bad actors and prevent additional attacks against health care by disseminating actionable intelligence to the field on the threat. Make no mistake, the Maui ransomware not only represents a threat to health care, but it also represents a national security threat. The North Korean regime, a designated state sponsor of terrorism, has a history of engaging in global criminal activity to fund its own illicit activities, including its nuclear weapons program. The American Hospital Association works very closely with the FBI on the local and national level to exchange cyber threat information, and we encourage all hospitals and health systems to develop working relationships with their local FBI and CISA offices — before becoming a victim of a cyberattack.”

For more information on how to connect with the FBI and Cybersecurity & Infrastructure Security Agency or on other cybersecurity and risk topics, contact Riggi at jriggi@aha.org.