IT Professor Katz comments on the latest ransomware attack on St. Joseph’s Candler

June 21, 2021

As mentioned in WTOC, the investigation is ongoing at St. Joseph’s/Candler Health System after a ransomware attack Thursday.

Hospital representatives say they took immediate steps to isolate the system and limit the potential impact.

Patients say they were turned away for treatment while others were able to go in like normal.

The ransomware attack at St. Joseph’s/Candler Health System has several people in our community concerned. Professor Frank Katz at Georgia Southern University’s Armstrong Campus, an assistant professor of Information Technology and the director of the Center for Applied Cyber Education, said crimes like this are becoming more common.

“The bad guy is really not really looking for everything down to your Instagram profile. They’re really not, they may obtain that, but what they are really trying to do is just what we call a denial of service attack, which is deny service to the hospital and extort money from them to get their service back,” Katz said.

Katz says those who are concerned about the cybersecurity at the health system should change their passwords, check their credit report and be aware of suspicious links, messages and more. He says hospitals have been the victim before.

“It is becoming a little more common and the idea of hitting a hospital like I said provides that sense of urgency, a whole host of employees that are available their information, plus the patient information and so the hospital compared to a business like gulfstream or like JCB or some other large business in Savannah doesn’t provide all of that information that a hospital would,” Katz said.

Katz says without a better picture of the attack against St. Joseph’s/Candler, it is unclear how long this will play out or when it will be resolved.

While some patients we talked to say they left without treatment others were able to carry on with their procedures using paper and pencil. A spokesperson with the health system says they are prioritizing patient care using back-up processes. They say it is critically important to protect the investigation but will share updates as appropriate. Katz says crimes like this are difficult to work for authorities.

“They have experts who are able to go in and look at how the data was attacked or how the system was attacked and work backwards to try and determine who the hacker was, they can get perhaps at least one what we call internet protocol address,” Katz said.

St. Joseph’s/Candler said in a statement that if personal or health information is involved, they will notify those affected.

They released the following statement to WTOC Thursday afternoon:

“On the morning of June 17, St. Joseph’s/Candler became aware of suspicious computer network activity. As a security measure, SJ/C took immediate steps to isolate systems and to limit the potential impact.

We also promptly initiated an investigation into the scope of the incident, which is ongoing and in its early stages, although SJ/C has confirmed that the incident involved ransomware. Law enforcement has been notified. If we determine that personal or health information is involved in this incident, we will notify those individuals in accordance with applicable law.

Nothing is more important to us than continuing to provide the care our patients expect. Patient care operations continue at our facilities using established back-up processes and other downtime procedures. Our physicians, nurses and staff are trained to provide care in these types of situations and are committed to doing everything they can to mitigate disruption and provide uninterrupted care to our patients.

We thank our patients for their patience during this time and apologize for any delays they may experience as we continue to work diligently to address this situation. We will continue to provide updates as appropriate.”