--- title: Cybercrime Warning for Health Providers | ClearDATA description: Security and compliance tips and best practices to implement today, and resources to help protect your sensitive data from cyberattacks and cyberthreats. image: https://cspm.cleardata.com/hubfs/Imported_Blog_Media/philipp-katzenberger-1313574-unsplash-scaled-1-2.jpg --- [Log in to the CyberHealth™ Platform](http://cyberhealth.cleardata.com/) [Talk to a Cloud Expert](https://www.cleardata.com/consultation/) [![Clear data](https://cspm.cleardata.com/hubfs/Cleardata_February2025/images/cleardata-logo.svg)](https://www.cleardata.com/) - [CSPM for Healthcare](https://www.cleardata.com/cspm) - - [Safeguards: HIPAA, HITRUST, GDPR, ISO, NIST, PCI](https://www.cleardata.com/cspm/#cspm-features) - [Automated Compliance](https://www.cleardata.com/cspm/#cspm-features) - [Cloud Risk Identification & Remediation](https://www.cleardata.com/cspm/#cspm-features) - [Compliance Risk Scores](https://www.cleardata.com/cspm/#cspm-features) - [PHI Leak Discovery](https://www.cleardata.com/cspm/#cspm-features) - [Audit-Ready Reporting](https://www.cleardata.com/cspm/#cspm-features) - Services - Managed Services - [Cloud Compliance](https://www.cleardata.com/cloud-compliance/) - [Managed Detection & Response](https://www.cleardata.com/cspm/managed-detection-and-response/) - [Cloud Operations](https://www.cleardata.com/cspm/cloud-operations/) - [Professional Services](https://www.cleardata.com/cspm/cloud-transformation/) - [Cloud Migration & Modernization](https://www.cleardata.com/cspm/cloud-transformation/#migration) - [Cloud Assessments](https://www.cleardata.com/cspm/cloud-transformation/#assessments) - [End-to-End Cloud Resilience](https://www.cleardata.com/cspm/cloud-transformation/#end2end) - Solutions - By Market - [Healthcare Software & Services](https://www.cleardata.com/solutions-by-market/healthcare-software-services/) - [Medical Devices & Equipment](https://www.cleardata.com/solutions-by-market/medical-devices-equipment/) - [Healthcare Providers](https://www.cleardata.com/solutions-by-market/medical-devices-equipment/) - [Healthcare Payers](https://www.cleardata.com/solutions-by-market/healthcare-payers/) - By Topic - - [Risk Visualization & Prioritization](https://www.cleardata.com/risk-visualization-prioritization/) - [Threat Detection & Protection](https://www.cleardata.com/security-threat-protection/) - [Cost & Performance Optimization](https://www.cleardata.com/cost-performance-optimization/) - [Healthcare Cloud Compliance](https://www.cleardata.com/healthcare-cloud-compliance/) - [Analytics & Reporting](https://www.cleardata.com/analytics-reporting/) - [GxP for Life Sciences](https://www.cleardata.com/gxp-life-sciences/) - [EHR Deployments in the Cloud](https://www.cleardata.com/ehr-cloud-deployments/) - Resources - - [View All](https://www.cleardata.com/resources/) - [Blog](https://www.cleardata.com/blog/) - [What Is Compliance Debt?](https://www.cleardata.com/blog/eliminating-compliance-debt-the-key-to-healthcare-tech-innovation/) - [Customer Stories](https://www.cleardata.com/stories/) - [Events](https://www.cleardata.com/events/) - [About](https://www.cleardata.com/about-us/) - - [Leadership Team](https://www.cleardata.com/about-us/leadership-team/) - [Careers](https://www.cleardata.com/about-us/careers/) - [News](https://www.cleardata.com/about-us/news/) - [Partners](https://www.cleardata.com/supported-clouds/) - [CSPM for Healthcare](https://www.cleardata.com/cspm) - - [Safeguards: HIPAA, HITRUST, GDPR, ISO, NIST, PCI](https://www.cleardata.com/cspm/#cspm-features) - [Automated Compliance](https://www.cleardata.com/cspm/#cspm-features) - [Cloud Risk Identification & Remediation](https://www.cleardata.com/cspm/#cspm-features) - [Compliance Risk Scores](https://www.cleardata.com/cspm/#cspm-features) - [PHI Leak Discovery](https://www.cleardata.com/cspm/#cspm-features) - [Audit-Ready Reporting](https://www.cleardata.com/cspm/#cspm-features) - Services - Managed Services - [Cloud Compliance](https://www.cleardata.com/cloud-compliance/) - [Managed Detection & Response](https://www.cleardata.com/cspm/managed-detection-and-response/) - [Cloud Operations](https://www.cleardata.com/cspm/cloud-operations/) - [Professional Services](https://www.cleardata.com/cspm/cloud-transformation/) - [Cloud Migration & Modernization](https://www.cleardata.com/cspm/cloud-transformation/#migration) - [Cloud Assessments](https://www.cleardata.com/cspm/cloud-transformation/#assessments) - [End-to-End Cloud Resilience](https://www.cleardata.com/cspm/cloud-transformation/#end2end) - Solutions - By Market - [Healthcare Software & Services](https://www.cleardata.com/solutions-by-market/healthcare-software-services/) - [Medical Devices & Equipment](https://www.cleardata.com/solutions-by-market/medical-devices-equipment/) - [Healthcare Providers](https://www.cleardata.com/solutions-by-market/medical-devices-equipment/) - [Healthcare Payers](https://www.cleardata.com/solutions-by-market/healthcare-payers/) - By Topic - - [Risk Visualization & Prioritization](https://www.cleardata.com/risk-visualization-prioritization/) - [Threat Detection & Protection](https://www.cleardata.com/security-threat-protection/) - [Cost & Performance Optimization](https://www.cleardata.com/cost-performance-optimization/) - [Healthcare Cloud Compliance](https://www.cleardata.com/healthcare-cloud-compliance/) - [Analytics & Reporting](https://www.cleardata.com/analytics-reporting/) - [GxP for Life Sciences](https://www.cleardata.com/gxp-life-sciences/) - [EHR Deployments in the Cloud](https://www.cleardata.com/ehr-cloud-deployments/) - Resources - - [View All](https://www.cleardata.com/resources/) - [Blog](https://www.cleardata.com/blog/) - [What Is Compliance Debt?](https://www.cleardata.com/blog/eliminating-compliance-debt-the-key-to-healthcare-tech-innovation/) - [Customer Stories](https://www.cleardata.com/stories/) - [Events](https://www.cleardata.com/events/) - [About](https://www.cleardata.com/about-us/) - - [Leadership Team](https://www.cleardata.com/about-us/leadership-team/) - [Careers](https://www.cleardata.com/about-us/careers/) - [News](https://www.cleardata.com/about-us/news/) - [Partners](https://www.cleardata.com/supported-clouds/) # CISA, FBI and HHS Issue Cybercrime Warning to Healthcare Providers October 29, 2020 6 minute read [mailto:?body=https://cspm.cleardata.com/cleardata-blog/blog/cyber-threat-healthcare-providers](mailto:?body=https://cspm.cleardata.com/cleardata-blog/blog/cyber-threat-healthcare-providers) ### [![2024-Threat-Report-data-1](https://cspm.cleardata.com/hubfs/Cleardata_February2025/images/2024-Threat-Report-data-1.jpg) Guide 2024 Healthcare Threat Report Learn More](https://www.cleardata.com/resources/healthcare-threat-report/) #### Table of Contents ![](https://cspm.cleardata.com/hs-fs/hubfs/Imported_Blog_Media/Bowen-Chris-800-200x200-Sep-18-2025-09-09-06-1454-PM.jpg?width=200&height=200&name=Bowen-Chris-800-200x200-Sep-18-2025-09-09-06-1454-PM.jpg) *by **Chris Bowen**Chief [Privacy](https://www.cleardata.com/legal/privacy-policy/) & Security Officer and Founder [ClearDATA](https://www.cleardata.com/)* Wednesday afternoon, the Department of Health and Human [Services](https://www.cleardata.com/services-descriptions/) (HHS), the FBI and the Cybersecurity and Infrastructure Security Agency ([CISA](https://www.cleardata.com/blog/reducing-successful-cyber-attack-vectors/)) [issued an announcement](https://us-cert.cisa.gov/ncas/alerts/aa20-302a) that they had “**credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers**.” They issued this warning urging healthcare providers to ensure they take timely and reasonable precautions to protect their networks from these threats, typically resulting in malware/ransomware attacks. In this October 29 [Healthcare IT News](https://www.healthcareitnews.com/news/fbi-hhs-warn-increased-and-imminent-cyber-threat-hospitals) article, Mike Miliard reports “Malicious cyber actors may soon be planning to infect systems with Ryuk ransomware for financial gain on a scale not yet seen across the American healthcare system.” These attacks to the healthcare system have been ramping up during COVID-19 and in his article Miliard quotes cybersecurity expert Brian Krebs saying he “received a tip about cybercriminals affiliated with the a Russia-speaking ransomware group known as Ryuk discussing plans to deploy ransomware at more than 400 healthcare facilities in the US.” Often targeted by Trickbot malware, the results to our health systems are devastating ranging from ransomware and data theft to diverted or denied patient services as systems have to go offline, which could prove fatal to those in need. The tragedy is that these bad actors are choosing this time to ramp up as our nation’s providers battle a third wave of COVID-19, which has strained resources to the breaking point. I urge any of you working in security to read the announcements linked here and heighten your awareness, while shoring up your defenses, just as we are. Educate your teams on how to be suspicious and cautious. #### Here’s what you should seriously consider doing today: - Ensure all domain controllers are patched for [Zerologon](https://success.trendmicro.com/solution/000270328) - Disable [Powershell with Group Policy](https://activedirectorypro.com/disable-powershell-with-group-policy/) - Monitor for the use of suspicious .bat files - Regularly backup all data, air gap and password protect backup copies \*offline\* - Block domains and IPs associated with Ancher\_DNS - Patch your systems - Monitor for http requests (via wget or curl, etc. ) to those urls mentioned in the CISA brief (see heading ‘This malware used the following legitimate domains to test internet connectivity’) - Follow the guidance of CISA (see [https://us-cert.cisa.gov/ncas/alerts/aa20-302a](https://us-cert.cisa.gov/ncas/alerts/aa20-302a)) #### Here are a few other best practices you can and should employ: - Know where your PHI is, and make sure it’s encrypted and backed up to a secured, separate location. The backups in a ransomware attack are critical. An attacker loses significant leverage if there are backups of the data that they do not have access to exfiltrate. - Along the encryption lines, have a strong key management strategy that ensures the encryption keys are secured separately to prevent the encrypted data from being used. - Secure your databases. While healthcare generally knows how to secure their databases, I’ve seen healthcare providers spin up vulnerable databases without rigorous controls and [compliance](https://www.cleardata.com/healthcare-cloud-compliance/) checks. I recommend an automation first approach to remove the human element from the configuration steps to secure these databases. - Stop reusing weak or already compromised passwords. - Don’t click links that shouldn’t be clicked. - IT could help prevent phishing attacks by tightening up content filters and domain validation on their email and firewalls. - Weak passwords, phishing attacks, and failure to patch are often the root cause of most ransomware attacks. - Patch those security holes. - Dust off your failover strategy and location. This approach is harder in the on-premise world because acquiring space, servers, and cabling is tough at the best of times – let alone when lives are potentially impacted. Cloud [environments](https://www.cleardata.com/cleardata-managed-services-regulated-environments/) and their multiple regions and availability can make this easier. You can also store backups in a different region – with different protections. #### **Here are some additional resources we have found to be helpful:** - [The CISA Alert (includes indicators of compromise)](https://us-cert.cisa.gov/ncas/alerts/aa20-302a) - [Protection Recommendations from Trend Micro](https://success.trendmicro.com/solution/000280291) - [Mandiant’s list of domains and IPs used by the malware in past attacks](https://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e832456) - [The Krebbs report that details how the information led to the alert by HHS, FYI, and CISA](https://krebsonsecurity.com/2020/10/fbi-dhs-hhs-warn-of-imminent-credible-ransomware-threat-against-u-s-hospitals/) Secure Your Healthcare Cloud ## Speak with a healthcare cybersecurity and compliance expert today. [Speak with an expert](https://www.cleardata.com/consultation/) ### [![Webinar Offers Ways to Protect Your Organization from Ransomware Attacks](https://cspm.cleardata.com/hubfs/Imported_Blog_Media/jefferson-santos-450403-unsplash-scaled-1-2.jpg) Webinar Offers Ways to Protect Your Organization from Ransomware Attacks](https://cspm.cleardata.com/cleardata-blog/blog/ransomware-protection-webinar) ### [![Reducing Successful Cyber Attack Vectors: Key Strategies This National Cybersecurity Awareness Month](https://cspm.cleardata.com/hubfs/Imported_Blog_Media/Stay-Safe-Online.png) Blog Reducing Successful Cyber Attack Vectors: Key Strategies This National Cybersecurity Awareness Month](https://cspm.cleardata.com/cleardata-blog/blog/reducing-successful-cyber-attack-vectors) ### [![Best Practices for Medical Device Cybersecurity in Healthcare](https://cspm.cleardata.com/hubfs/Imported_Blog_Media/shutterstock_1100101856-2.jpg) Blog Best Practices for Medical Device Cybersecurity in Healthcare](https://cspm.cleardata.com/cleardata-blog/blog/medical-device-cybersecurity-best-practices) [![Clear data](https://cspm.cleardata.com/hubfs/Cleardata_February2025/images/cleardata-logo.svg "Clear data")](https://www.cleardata.com/) - [CSPM for Healthcare](https://www.cleardata.com/cspm) - [Safeguards: HIPAA, HITRUST, GDPR, ISO, NIST, PCI](https://www.cleardata.com/cspm/#cspm-features) - [Automated Compliance](https://www.cleardata.com/cspm/#cspm-features) - [Cloud Risk Identification & Remediation](https://www.cleardata.com/cspm/#cspm-features) - [Compliance Risk Scores](https://www.cleardata.com/cspm/#cspm-features) - [PHI Leak Discovery](https://www.cleardata.com/cspm/#cspm-features) - [Audit-Ready Reporting](https://www.cleardata.com/cspm/#cspm-features) - Services - Managed Services - [Cloud Compliance](https://www.cleardata.com/cloud-compliance/) - [Managed Detection & Response](https://www.cleardata.com/cspm/managed-detection-and-response/) - [Cloud Operations](https://www.cleardata.com/cspm/cloud-operations/) - [Professional Services](https://www.cleardata.com/cspm/cloud-transformation/) - [Cloud Migration & Modernization](https://www.cleardata.com/cspm/cloud-transformation/#migration) - [Cloud Assessments](https://www.cleardata.com/cspm/cloud-transformation/#assessments) - [End-To-End Cloud Resilience](https://www.cleardata.com/cspm/cloud-transformation/#end2end) - Solutions - By Market - [Healthcare Software & Services](https://www.cleardata.com/solutions-by-market/healthcare-software-services/) - [Medical Devices & Equipment](https://www.cleardata.com/solutions-by-market/medical-devices-equipment/) - [Healthcare Providers](https://www.cleardata.com/solutions-by-market/healthcare-providers/) - [Healthcare Payers](https://www.cleardata.com/solutions-by-market/healthcare-payers/) - By Topic - [Risk Visualization & Prioritization](https://www.cleardata.com/risk-visualization-prioritization/) - [Threat Detection & Protection](https://www.cleardata.com/security-threat-protection/) - [Cost & Performance Optimization](https://www.cleardata.com/cost-performance-optimization/) - [Healthcare Cloud Compliance](https://www.cleardata.com/healthcare-cloud-compliance/) - [Analytics & Reporting](https://www.cleardata.com/analytics-reporting/) - [GxP For Life Sciences](https://www.cleardata.com/gxp-life-sciences/) - [EHR Deployments In The Cloud](https://www.cleardata.com/ehr-cloud-deployments/) - Resources - [View All](https://www.cleardata.com/resources) - [Blog](https://www.cleardata.com/blog/) - [What Is Compliance Debt?](https://www.cleardata.com/blog/eliminating-compliance-debt-the-key-to-healthcare-tech-innovation/) - [Events](https://www.cleardata.com/events/) - [Customer Stories](https://www.cleardata.com/cloud-case-studies/) - About - [Leadership Team](https://www.cleardata.com/about-us/leadership-team/) - [Careers](https://www.cleardata.com/about-us/careers/) - [News](https://www.cleardata.com/about-us/news/) - [Cloud Partners](https://www.cleardata.com/supported-clouds) - [Microsoft Azure](https://www.cleardata.com/cspm/microsoft-azure/) - [Amazon Web Services (AWS)](https://www.cleardata.com/cspm/aws/) - [Google Cloud Platform](https://www.cleardata.com/cspm/google-cloud/) © 2026 CLEARDATA All rights reserved - [Privacy Policy](https://www.cleardata.com/legal/privacy-policy) - [Notice of Copyright Infringement](https://www.cleardata.com/legal/notice-of-copyright-infringement) - [Acceptable Use Policy](https://www.cleardata.com/legal/acceptable-use-policy/) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Chris Bowen", "url" : "https://cspm.cleardata.com/cleardata-blog/author/chris-bowen" }, "dateModified" : "2025-09-18T21:10:55.812Z", "datePublished" : "2020-10-29T18:27:17.000Z", "headline" : "Cybercrime Warning for Health Providers | ClearDATA", "image" : [ "https://cspm.cleardata.com/hubfs/Imported_Blog_Media/philipp-katzenberger-1313574-unsplash-scaled-1-2.jpg" ], "mainEntityOfPage" : { "@id" : "https://cspm.cleardata.com/cleardata-blog/blog/cyber-threat-healthcare-providers", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://cspm.cleardata.com/hubfs/ClearDATA-logo-1540.png" } } } ```