Ransomware Attack Impacts More Than 400 U.S. Dental Practices
A ransomware attack on a medical record backup service has prevented hundreds of dental practices in the United States from accessing their patients’ records.
The attack occurred on August 26, 2019 and affected the DDS Safe backup solution developed by Wisconsin-based software company, Digital Dental Record (DDS). The DDS system was accessed via an attack on its cloud management provider, West Allis, WI-based PerCSoft. Ironically, the DDS website states DDS Safe helps to protect dental practices against ransomware attacks.
The attack did not affect all dental practices using the DDS Safe solution. Initial reports suggest between 400 and 500 of the 900 dental practices using the solution have been affected by the REvil/Sodinokibi ransomware attack.
PerCSoft, assisted by a third-party software company, has obtained a decryptor and is in the process of recovering the encrypted files. According to a statement from DDS, recovery of files is estimated to take between 30 minutes to 4 hours per client.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Some dental practices have reported file loss as a result of the attack and others have said the decryption process did not work. With the attack coming so close to the end of the month, several dental practices have expressed concern that the attack would prevent them from processing payroll payments. At the time of writing, around 100 dental practices have successfully recovered their files.
Since there is no free decryptor for REvil ransomware available through the NoMoreRansom project, it is highly probably that the ransom was paid. That has not been confirmed publicly by either company, although Brian Krebs of Krebs on Security said several sources have confirmed that PerCSoft paid the ransom to obtain the decryptor.
The ransom amount is unknown, but one Reddit user claims PerCSoft – or its insurer – paid $5,000 per client for the decryptor. That would put the total ransom demand at $2.5 million, which is the same as the demand for the coordinated Sodinokibi ransomware attack that affected 22 government entities in Texas earlier this month.
Both attacks impacted multiple entities by attacking a software provider or managed service provider (MSP). This appears to be the modus oprandi of the threat actors behind the attack. Another attack in June targeted the MSP platform, Webroot SecureAnywhere, which allowed REvil/Sodinokibi ransomware to be deployed on clients’ systems.
The threat actors behind REvil ransomware are running a ransomware-as-a-service operation using a limited number of affiliates to distribute the ransomware. By using a small number of experienced affiliates, the threat actors hope to stay under the radar.
On hacking forums, the threat actors have been trying to recruit affiliates, five of whom have been guaranteed earnings of $50,000. Other affiliates have been told they will earn a minimum of $10,000. The threat actors are offering affiliates 60% of any ransom payments they generate and claim to be experienced, ‘professional’ ransomware developers that have been working in the field for the past five years.
While the code for REvil ransomware differs significantly from other ransomware variants, Tesorion researchers have found code similarities with the now defunct GandCrab ransomware, which was decommissioned this year. The threat actors behind GandCrab claimed to have retired after earning so much money from their ransomware-as-a-service operation over the past 18 months, although Tesorion researchers suspect at least some of the individuals involved in GandCrab may have got involved with or are responsible for REvil ransomware.
Regardless of who is behind the attacks, they are unlikely to windup such a profitable operation any time soon. As long as ransom demands continue to be paid by businesses and their insurers, the attacks will continue.
