Unlike e-records of general patients, the medical records of VIPs are stored in a physical form.
NEW DELHI: The perpetrators behind the cyberattack on the computer network system at the All India Institute of Medical Sciences (AIIMS) Delhi, which was discovered on 23 November, have failed to achieve their likely objective of getting possession of personal medical details of individuals who come in the Very Important Persons (VIP) category and had in the past or are still taking medical care at the hospital.
AIIMS Delhi, in most cases, is the first stop for Delhi-based politicians, Members of Parliament, members of the higher judiciary and of the bureaucracy for taking medical treatment because of the expertise the hospital offers and the “privileges” they get there.
However, unlike in the case of a common patient, whose details are stored electronically and for which an e-record is created and which has likely been compromised by the cyber terrorists in this recent incident, the details and medical records of VIPs are stored in a physical form. Even the medical samples of such VIPs are collected and collated while assigning them a bar code, rather than through the name of the person who has given the said sample, to maintain anonymity and privacy.
“It can be said with some degree of certainty that the medical records of the VIPs, which could have been misused with disastrous consequences, remained out of touch in the recent attack,” an official source told The Sunday Guardian.
Highly placed sources, aware of the matter, have confirmed to The Sunday Guardian that the attackers have indeed demanded a ransom amount to provide access to the files that they have taken in their control. However, these demands have been ignored by the decision makers.
The servers that were breached contain records related to registration, admission summary, discharge summary, all details attached with Unique Health Identification (UHID) number, including mobile and Aadhaar details of the patient. Medical research and clinical data of AIIMS, too, are likely to have been impacted.
The control of the servers, which have been compromised, are likely to be regained by the Indian authorities by this weekend and normal work is likely to resume by 5 December. According to the authorities, while the attack was discovered on 23 November, it was very much possible the systems were infected for a longer time and the hackers decided to make known of the attack to the hospital authorities only after they stole the data that they believe they needed to put pressure on the Indian government.
According to a cyber expert, who has investigated cyberattacks originating from Pakistan and China in the past, the ransomware group involved in the recent incident has likely exfiltrated sensitive data with the aim to sell it on underground forums. According to him, such ransomware extortion operations need a lot of time to be spent on the victim server and they should have been detected way before.
The hackers stole the information and then encrypted the servers and endpoint systems, for which they are demanding ransom money. The AIIMS officials, under its new director, M. Srinivas, who is making waves by bringing in a pro-people approach in the hospital, has ordered that in the wake of the recent “cyberattack”, no router will be connected to the AIIMS network and no computer that is on AIIMS LAN will be using a hotspot. All computers connected to the AIIMS network are being formatted. As per publicly available information, AIIMS runs on 40 physical servers and 100 virtual servers.