Iran Conducted Cyberattack On Boston Children's Hospital, FBI Says

Hackers working for the Iranian government last summer attempted to break into and damage computer systems at Boston Children's Hospital, the Wall Street Journal reports. The hospital is one of the biggest pediatric centers in the U.S., offering services ranging from cancer treatment to heart surgery. U.S. agencies in November said in a technical alert that Iranian hackers accessed "environmental control networks" at a children's hospital through a flaw in a cybersecurity appliance - describing the intrusion as part of a broader attack against critical infrastructure - but had not previously disclosed details or named the hospital. FBI Director Christopher Wray said that the alleged Iranian operation was either fully or partially foiled. The motive of the alleged cyberattack wasn't clear, but there was "the potential for a network to be shut down" or severely degraded in a way that could have significantly interrupted hospital operations, a U.S. official said. It is rare for the FBI to identify victims of cyberattacks.

Hospitals in the U.S. and around the world have become a top target of criminal cyber gangs in recent years and have suffered waves of ransomware attacks in which victims are extorted for payments to have their locked-up systems released. It is less common for such attacks to be tied to a foreign government. A U.S. official said the attack on the Boston Children's Hospital didn't progress enough to determine whether it could have led to the deployment of ransomware. Wray emphasized that there is a continuing shift by federal authorities to prevent damage from cyberattacks before they happen, rather than a more traditional approach of focusing on investigating and indicting criminal hackers. Wray urged companies to come forward and notify local FBI field offices as quickly as possible when they believe they have suffered a cyberattack.