Handa Hospital is seen in the town of Tsurugi, Tokushima Prefecture, on Nov. 9, 2021. (Mainichi/Yoko Kunimoto)

       TOKUSHIMA -- A municipal hospital in this western Japan prefecture on Nov. 26 announced it will spend 200 million yen (roughly $1.76 million) to build a new computer system instead of paying ransom after a late October cyberattack rendered electronic medical records of some 85,000 patients inaccessible to staff.

       Handa Hospital in the town of Tsurugi, Tokushima Prefecture, has stopped accepting new outpatients almost entirely following the cyberattack, but aims to resume regular operations from Jan. 4 next year.

       The hospital's computer system, which the electronic records run on, was infected with ransomware, an illicit type of software that encrypts data and demands funds to make them accessible again. The medical records were encrypted and the accounting system also went down. The printers spewed out papers with a message in English telling the hospital that if a ransom was not paid, the data would be released.

       The hospital has not received another request for ransom and no data leakage has been confirmed. It has hired a specialist firm to restore its data, but it has no idea when this might be completed.

       Tsurugi Mayor Shigeru Kanenishi explained, "We initially thought about paying the ransom, but there is no guarantee that it (the data) will be 100% restored. We decided that as a municipal government, we cannot pay a criminal group using public funds."

       Handa Hospital has apparently decided to continue creating medical records on paper for the time being, and will start operating a new system in January.

       Regarding the virus's infection path, the hospital explained that the ID and password of a virtual private network (VPN) used by a contractor to remotely inspect its system were leaked. The VPN device is an old model whose vulnerability was pointed out in the past, and it is highly likely that the system was infected via this route. The hospital announced it would take measures such as halting a continuous internet connection.

       (Japanese original by Yoko Kunimoto, Tokushima Bureau)

       Font Size S M L Print Timeline 0