Former infosec COO pleads guilty to attacking hospitals to drum up business
(2023/11/20)
- Reference: 1700500506
- News link: https://www.theregister.co.uk/2023/11/20/former_infosec_coo_pleads_guilty/
- Source link:
An Atlanta tech company's former COO has pleaded guilty to a 2018 incident in which he deliberately launched online attacks on two hospitals, later citing the incidents in sales pitches.
Under a plea deal he signed last week, Vikas Singla, a former business leader at network security vendor Securolytics – a provider to healthcare institutions, among others – admitted that in September 2018 he rendered the Ascom phone system of Gwinnett Medical Center inoperable.
Gwinnett Medical Center operates hospitals in Duluth and Lawrenceville and the deliberate disablement of the Ascom phone system meant the main communication line between doctors and nurses was unavailable to them.
[1]
More than 200 phones were taken offline, which were used for internal communications, including "code blue" incidents that often relate to cardiac or respiratory emergencies.
[2]
[3]
Singla also gained access to Gwinnett Medical Center's VPN, which in turn afforded him access to a Hologic R2 Digitizer, a device connected to mammogram machines. The device also stored the personal data of patients, including names, dates of birth, and sex.
For more than 300 patients, this data was stolen by Singla and added to a document called "Baidu.txt." Singla later executed a print job on more than 200 [4]printers across the two hospitals' campuses, revealing all the stolen data, along with the words "WE OWN YOU."
[5]
The [6]plea deal [PDF] stated that this could have caused "fear among medical staff and impair the provision of hospital services."
Singla then took to a now-closed Twitter/X account to post 43 tweets, publicizing the incident, with each of the 43 messages containing some stolen personal information from the mammogram's digitizer.
After all of the events had transpired, Securolytics began emailing potential clients regarding new business opportunities, citing the publicized attacks.
[7]UnitedHealthcare's broken AI denied seniors' medical claims, lawsuit alleges
[8]Mac daddy Woz hospitalized in Mexico over mystery malady
[9]Canada goosed as attackers shutter hospitals and China deepfakes its politicians
[10]AI girlfriend encouraged man to attempt crossbow assassination of Queen
Neither Securolytics nor Northside Hospital, Gwinnett Medical Center's new name, responded to The Register 's request for comment.
"Criminal disruptions of hospital computer networks can have tragic consequences," said acting assistant attorney general Nicholas L. McQuaid of the Justice Department's criminal division, at the time of Singla's 2021 indictment.
[11]
"The department is committed to holding accountable those who endanger the lives of patients by damaging computers that are essential in the operation of our healthcare system.
"This cyberattack on a hospital not only could have had disastrous consequences, but patients' personal information was also compromised," said aptly named Chris Hacker, special agent in charge of FBI Atlanta.
"The FBI and our law enforcement partners are determined to hold accountable, those who allegedly put people's health and safety at risk while driven by greed."
Guilty plea, but (maybe) no prison…
Pleading guilty to one count of intentional damage to a protected computer, Singla faces a maximum prison term of 10 years, though he may not ever see the inside of a cell.
The court was recommended to instead sentence Singla to 57 months of house detention due to his suffering an "extraordinary" rare and incurable form of cancer. Any delay to his surgery, should the cancer recur, may render his condition inoperable, according to the plea agreement.
The decision to recommend the alternative to incarceration was also influenced by a "dangerous" vascular condition, from which Singla also suffers.
He will have to pay $817,804.12 in restitution to Northside Hospital and Ace American Insurance Company for the damages incurred by the attack, plus any applicable interest that accrues by the time he's sentenced on February 15, 2024. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZVvlFOP41bSquFSuPZ0i7QAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZVvlFOP41bSquFSuPZ0i7QAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZVvlFOP41bSquFSuPZ0i7QAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2023/08/28/who_me/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZVvlFOP41bSquFSuPZ0i7QAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com/external/vikas-singla-plea-in-hack-georgia-hospital-11-16-23.pdf
[7] https://www.theregister.com/2023/11/15/unitedhealthcare_ai_medicine/
[8] https://www.theregister.com/2023/11/09/steve_wozniak_hospitalized_mexico/
[9] https://www.theregister.com/2023/10/25/canadian_hospitals_spamoflague/
[10] https://www.theregister.com/2023/10/06/ai_chatbot_kill_queen/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZVvlFOP41bSquFSuPZ0i7QAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
Under a plea deal he signed last week, Vikas Singla, a former business leader at network security vendor Securolytics – a provider to healthcare institutions, among others – admitted that in September 2018 he rendered the Ascom phone system of Gwinnett Medical Center inoperable.
Gwinnett Medical Center operates hospitals in Duluth and Lawrenceville and the deliberate disablement of the Ascom phone system meant the main communication line between doctors and nurses was unavailable to them.
[1]
More than 200 phones were taken offline, which were used for internal communications, including "code blue" incidents that often relate to cardiac or respiratory emergencies.
[2]
[3]
Singla also gained access to Gwinnett Medical Center's VPN, which in turn afforded him access to a Hologic R2 Digitizer, a device connected to mammogram machines. The device also stored the personal data of patients, including names, dates of birth, and sex.
For more than 300 patients, this data was stolen by Singla and added to a document called "Baidu.txt." Singla later executed a print job on more than 200 [4]printers across the two hospitals' campuses, revealing all the stolen data, along with the words "WE OWN YOU."
[5]
The [6]plea deal [PDF] stated that this could have caused "fear among medical staff and impair the provision of hospital services."
Singla then took to a now-closed Twitter/X account to post 43 tweets, publicizing the incident, with each of the 43 messages containing some stolen personal information from the mammogram's digitizer.
After all of the events had transpired, Securolytics began emailing potential clients regarding new business opportunities, citing the publicized attacks.
[7]UnitedHealthcare's broken AI denied seniors' medical claims, lawsuit alleges
[8]Mac daddy Woz hospitalized in Mexico over mystery malady
[9]Canada goosed as attackers shutter hospitals and China deepfakes its politicians
[10]AI girlfriend encouraged man to attempt crossbow assassination of Queen
Neither Securolytics nor Northside Hospital, Gwinnett Medical Center's new name, responded to The Register 's request for comment.
"Criminal disruptions of hospital computer networks can have tragic consequences," said acting assistant attorney general Nicholas L. McQuaid of the Justice Department's criminal division, at the time of Singla's 2021 indictment.
[11]
"The department is committed to holding accountable those who endanger the lives of patients by damaging computers that are essential in the operation of our healthcare system.
"This cyberattack on a hospital not only could have had disastrous consequences, but patients' personal information was also compromised," said aptly named Chris Hacker, special agent in charge of FBI Atlanta.
"The FBI and our law enforcement partners are determined to hold accountable, those who allegedly put people's health and safety at risk while driven by greed."
Guilty plea, but (maybe) no prison…
Pleading guilty to one count of intentional damage to a protected computer, Singla faces a maximum prison term of 10 years, though he may not ever see the inside of a cell.
The court was recommended to instead sentence Singla to 57 months of house detention due to his suffering an "extraordinary" rare and incurable form of cancer. Any delay to his surgery, should the cancer recur, may render his condition inoperable, according to the plea agreement.
The decision to recommend the alternative to incarceration was also influenced by a "dangerous" vascular condition, from which Singla also suffers.
He will have to pay $817,804.12 in restitution to Northside Hospital and Ace American Insurance Company for the damages incurred by the attack, plus any applicable interest that accrues by the time he's sentenced on February 15, 2024. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZVvlFOP41bSquFSuPZ0i7QAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZVvlFOP41bSquFSuPZ0i7QAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZVvlFOP41bSquFSuPZ0i7QAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2023/08/28/who_me/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZVvlFOP41bSquFSuPZ0i7QAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com/external/vikas-singla-plea-in-hack-georgia-hospital-11-16-23.pdf
[7] https://www.theregister.com/2023/11/15/unitedhealthcare_ai_medicine/
[8] https://www.theregister.com/2023/11/09/steve_wozniak_hospitalized_mexico/
[9] https://www.theregister.com/2023/10/25/canadian_hospitals_spamoflague/
[10] https://www.theregister.com/2023/10/06/ai_chatbot_kill_queen/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZVvlFOP41bSquFSuPZ0i7QAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
Yorick Hunt
"It reminds me of the early 1990s when a certain anti-virus vendor was suspected of creating viruses to further the sales of their product."
I remember that well, but no names mentioned out of respect for the deceased.
"a former business leader"
Pascal Monett
Yup. Former. As in, won't ever be a business leader again.
I would like those medical conditions verified, but in any case, there is no excuse for attacking hospitals.
That should be a capital crime. You got cancer ? Well you'll be treated in prison. If the phones work.
Re: "a former business leader"
The Oncoming Scorn
The court was recommended to instead sentence Singla to 57 months of house detention due to his suffering an "extraordinary" rare and incurable form of cancer. Any delay to his surgery, should the cancer recur, may render his condition inoperable, according to the plea agreement.
The decision to recommend the alternative to incarceration was also influenced by a "dangerous" vascular condition, from which Singla also suffers.
Both seem a tad convienent & I agree with getting this verified by a independent medical facility, with the latter condition of "dangerous" vascular condition I can only assume he lacks a heart along with his brain.
Eitherway I hope the medical staff treating him are fully aware of the pondlife they are treating & give him all the inappropriate care & attention he warrants.
Re: "a former business leader"
G.Y.
If it were a capital crime (e.g. shooting at dawn), prison treatment would not have been an issue.
It reminds me of the early 1990s when a certain anti-virus vendor was suspected of creating viruses to further the sales of their product.
> an "extraordinary" rare and incurable form of cancer and a "dangerous" vascular condition,
And the records that show he actually has these imprisonment-avoiding conditions are conveniently stored on a network that he has hacked into. Ingenious!
I hope they jail him for a long time.