Image courtesy UCLA Medical Center/Fotalia

Cyber Attack Targets UCLA Hospital System
| published July 18, 2015 |

By Keith H. Roberts Thursday Review contributor

The records and personal information of at least 4.5 million patients may have been exposed to hackers during a sustained cyber-attack on the University of California at Los Angeles medical and hospital system, an attack which was finally discovered and thwarted.

The attack may have lasted for months, and though it is not clear that the hackers actually stole the personal data found on the hospital system’s vast computer network, law enforcement officials and hospital administrators are not ruling out the deliberate theft of patient information—including Social Security numbers, birth dates, addresses, phone numbers, and payment and billing records. Also at risk: patient ID numbers and Medicare records, as well as insurance documents.

The UCLA hospital system has in the meantime hired several cyber-security teams to investigate the breach, and to try to determine what damage has been done. The cyber team will also be looking for ways to upgrade the hospital’s computer network to make it more difficult for hackers to breach the system.

The hospital system has offered free credit monitoring and identity-theft protection for millions of its customers and patients. The attack involved the computer networks at four major hospitals and numerous smaller satellite operations and regional clinics.

The UCLA data breach is the third major known cyber-attack on a hospital chain or medical insurance firm in the last year. Anthem Incorporated revealed earlier this year that it had been the victim of a sustained cyber-attack by Chinese hackers, and that’s its vast cache of patient and customer data had been compromised (including names, Social Security numbers, addresses, phone numbers, and email addresses). Last summer, Community Health Systems—a hospital management company and one of the largest hospital chains in North America—acknowledged that it had been the victim of a massive cyber-attack, in which the personal data of millions of patients and employees were stolen using a vulnerability known as Heartbleed. The FBI believes that the attack on CHS was the work of Chinese hackers, though U.S. officials have not narrowed the blame to a state-sponsored assault or the work of independent hackers.

Investigators believe that the cyber-attack on the UCLA hospital system may have begun as early as late last year, but escalated throughout 2015 as the hacker accumulated additional knowledge about the network. Officials with UCLA and with the hospital say that they will soon have digital safeguards in place which will prevent future breaches of the medical center’s computer systems.

In the meantime, law enforcement officials and security analysts are working to determine exactly what type of data the hackers may have stolen. Investigators will also look closely at any digital evidence left behind which might give them a clue as to the country where the hackers were based. Code used to enter computer networks can often contain clues which will indicate the possible origin of cyber-attacks.

Related Thursday Review articles:

More Than 22 Million Impacted by Cyber-Attack; R. Alan Clanton; Thursday Review; July 9, 2015.

Taxpayer Information Stolen From IRS Website; Keith H. Roberts; Thursday Review; May 27, 2015.