Lessons Learned: Cyberattack Shutters Five Illinois Healthcare Facilities

On Oct 22, 2023

Growing Cyber Attacks Pose Existential Threats to Business – Can More Connected And Efficient Security Help Organizations Gain The Upper Hand?

By Emily L. Phelps, Director & Cybersecurity Advocate, Cyware

St. Margaret’s Health of Illinois was forced to shut down two hospitals and three clinics, almost two years after struggling to recover from a prolonged ransomware attack in 2021. Even veteran cybersecurity experts accustomed to troubling breach and impact news took note.

The attack had persistent impacts; it kept their network down for three months and prevented them from billing insurers, Medicaid, or Medicare for months afterward.

“We could not access any of our information system, including email and the EMR,” said Linda Burt, vice president of quality and community service at St. Margaret’s Health. “We had to resort to paper for medical records. It took many months, and in some service lines, almost a year to get back online and enter any charges or send out claims. Many of the insurance plans have timely filing clauses which, if not done, they will not pay. So, no claims were being sent out and no payment was coming in.”

The ransomware attack shut down the spring valley hospital computer network and ceased all web-based operations, including the patient portal. Coupled with the impacts of the COVID-19 pandemic, the attack’s cascading impacts proved insurmountable.

St. Margaret’s 18-plus month recovery effort failed and on June 16, 2023, the five facilities closed for good.

A Hidden Culprit – Security Data Silos

One of the frustrations security practitioners experience with cyberattacks like this is that while the ransomware spread quickly, the data that could have helped the team defend against it didn’t. Threat intelligence data is often stranded – isolated in ‘data silos’ separately managed within various functional groups.

The average organization of St. Margaret’s size uses dozens of discrete security tools, many of which don’t share their data or connect directly to other security tools, outside of their own application and assigned management group.

Given the high volume of threats and security alerts flooding analysts, these data silos can lead to dangerously slow responses. While tools are helpful – and necessary – cybersecurity pros need more than point solutions to defend against collaborative, persistent attackers.

This is where orchestration across silos, AI-driven automation, and collaboration tools can play an important part. AI and machine learning don’t replace humans, but they can pull together diverse data streams, consolidate redundant data to reduce the noise, integrate threat intelligence into SOC operations, and enable security teams to automate some responses and act immediately on others.

Equally important and often overlooked is the need to automate alerts with the right information, and get them to the right people as quickly as possible. The status quo for many teams is to track threats on spreadsheets and communicate by email, if at all. Best case – it can take days to weeks to alert the right people and concisely tell them what they need to know.

But by automating the tedious work and sharing context-rich information immediately, security experts can pinpoint attacks and take intelligent action – before irreparable damage occurs.

The TIP-ing Point: Leveraging Existing Intel to Thwart Future Attacks

The path to integrate threat intelligence platforms (TIP) with data orchestration and workflow automation (SOAR) seems daunting for many organizations.

It doesn’t have to be.

First, we need to think more proactively – reacting to incident alerts and then scrambling to identify the best response leaves adversaries with an advantage. But proactive security certainly has its challenges; trying to spot looming threats has been dismissed as too difficult and expensive.

Frankly, wading through millions of data points is not a human-scale problem. Without tools to effectively process, analyze, and prioritize data, these internal clues often remain undetected, or are discovered forensically, long after attacks have occurred.

Today’s security challenges are less about detection than they are about connecting the dots. With the growing number of tools, there is lots of overlap, and adding new tools has diminishing returns. Ultimately, we need better ways to integrate, connect, and orchestrate action across the security tools we already have.

St. Margaret’s serves as a stark reminder of the worst-case scenario for a small healthcare organization. Without enough resources to invest in robust security, updated systems, and without having a clear recovery plan, these important local providers can be put out of business, leaving their communities with limited – if any – healthcare services.

This is an industry-wide problem, yet we expect our under-resourced teams to defend themselves against perpetual threats. Visibility is critical to detection. Automation is critical to scale. Intelligence and alerting are critical in order to take action. But we can’t rely solely on independent tools. We must invest in pragmatic systems that can integrate, share, and contextualize quickly, reliably, and with confidence, and make these capabilities available as managed services for smaller organizations.

About the Author

Emily L. Phelps has written about and worked in the cybersecurity space for nearly a decade. Throughout her career, she has helped translate complex technical material into digestible insights for business leaders, and she has supported cybersecurity initiatives and solutions in order to assist practitioners in their day-to-day work. Emily is a fierce advocate for pragmatic cybersecurity programs that enable organizations to operate, uninterrupted, by cyber threats.