Weeks after the cyberattack, the IT system of the Israeli hospital still does not work

A month after a group of hackers attacked the Hillel Yaffe Medical Center in Hadera, its IT infrastructure has yet to be restored, the hospital director told the Knesset Health Committee on Monday, while a cybersecurity official denounced that the event could probably have been avoided if Israel’s hospitals were considered critical infrastructure and therefore required a higher level of protection.

The committee met to discuss the current state of the country’s health system against the risk of cyberattacks.

“We hope this week we can reboot our system,” said Dr. Mickey Dudkiewicz of Hallel Yaffe, adding that it could still take weeks to complete the process and other hospitals facing similar situations have taken even months.

When asked about the cost of the operation, the doctor said it was in the order of millions of shekels.

The successful ransomware attack on the medical center early last month sounded an alarm among Israeli health authorities and organizations regarding its exposure to cyber threats.

Nurses review the medical records of two patients with coronavirus disease (COVID-19) within the intensive care unit at Humber River Hospital in Toronto, Ontario, Canada, on April 15, 2021 (credit: REUTERS / CARLOS OSORIO) .

Israeli public and private organizations are a preferred target for attacks carried out by hackers with ideological and financial motivations, as was the case with Hillel Yaffe.

According to Erez Tidhar, director of the Israel National Cyber ​​Directorate Monitoring and Analysis Center, the event probably could have been avoided. Management is responsible for cyber defense in the civil sphere, including issuing policies and offering guidance.

“Today, critical organizations such as banks and hospitals are not defined as critical state infrastructure and their cybernetic system is deficient,” he told the committee. “If it were considered as such, and I say this with caution, a similar attack probably would not have occurred. We have not yet seen a massive attack on critical infrastructure that has been successful. “

The issue of elevating hospitals to the level of critical infrastructure has been debated for years, several experts noted during the meeting.

“I hope that decision makers in the country understand that it is impossible to give a body like ours the responsibility of such organizations without due authority,” added Tidhar.

Tidhar also revealed that there had been an alert about a possible attack on Hillel Yaffe months before the episode.

“As early as June we issued an alert directed at various organizations in the State of Israel, including Hillel Yaffe,” he said. “They received an alert and instructions on how to fix the weakness.”

Dudkiewicz denied any warning.

“This has been a national event with all its implications, and its management did not depend on the decisions of the hospital,” he said, adding that when the attack occurred, cooperation with the relevant agencies was very fruitful.

“In the last few years we have spent huge amounts in the field of cyber defense and we have passed all the tests successfully,” said Dudkiewicz. “This shows that we have to change our perception and understand that even at the highest level of security, we must be aware that something like this can happen and know how to react quickly.”

Since 2016, the Ministry of Health has created a unit dedicated to cybersecurity that employs about 30 people full-time.

“In a way, we are talking about World War III,” said the ministry’s chief technology officer, Reuven Eliyahu. “If ever a country needed ships and missiles to attack another nation, today a simple website is enough. The attackers are much more than the defenders and the problem is intensifying ”.

“We encounter more than 100,000 cyberattacks against healthcare organizations a month and we frustrate them,” he added.

Following the attack in Hillel Yaffe, the ministry distributed some new guidelines for health organizations to prevent attacks, and new regulations for this purpose are expected to be issued in late December.

Eliyahu said the new plan will require additional resources.


Related Posts

Leave a Reply

Your email address will not be published. Required fields are marked *