Ransomware hackers are targeting managed service providers, causing chaos for the city governments, medical clinics, and smaller businesses who use them for IT
On July 3, employees at Arbor Dental in Longview, Washington, noticed glitches in their computers and couldn't view X-rays. Tweets: @propublica , @sesmith , @propublicail , @propublica , @guptamnka , @propublica , and @danlgolden Tweets: @propublica : Here's what it looks like when a hacker installs ransomware. A victim's virus protection is disabled, and hackers check to make sure the ransomware is encrypting the computer's files. https://www.propublica.org/... https://twitter.com/... S. E. Smith / @sesmith : Managed service providers handle data for medical offices, cities, and more. They make a juicy target for hackers, allowing them to hit all their clients with one stroke. https://www.propublica.org/... ProPublica Illinois / @propublicail : In Texas, one ransomeware attack crippled 22 cities and towns. Another in Wisconsin deprived 400 dental practices around the country of access to electronic files. Welcome to the new (and worrisome) frontier in ransomware. http://bit.ly/2NbOrH8 @propublica : Cybercriminals are going after managed service providers. The shortcomings of MSPs have a larger consequence: They foster the spread of ransomware. https://propub.li/2I4EGX1 Monika Gupta / @guptamnka : “The remote management tools are like golden keys to immediately distribute ransomware,” said @KyleHanslovan. Great piece by @Renee_Dudley on how MSPs are often targeted by hackers. https://www.propublica.org/... @propublica @propublica : Hackers have paralyzed thousands of towns and small businesses this year by exploiting poor cybersecurity at the outside firms that handle their computer systems. https://propub.li/2AeW8Uw Dan Golden / @danlgolden : As the coordinated attack on 22 Texas towns showed, ransomware hackers have a new strategy to create more havoc (and make more $$$) for less work — targeting providers of IT services for towns and medical clinics. Read Renee Dudley's fascinating story: https://www.propublica.org/...
Context & Ripple Effects
ProPublica's reporting documents how attackers stopped breaking into victims one at a time and started compromising the IT firms that manage networks for dozens of clients at once — the coordinated campaigns that crippled 22 Texas towns and 400 dental practices all traced back to their managed service providers.
Arbor Dental's locked-out X-rays are the small end of a pattern that later coverage shows scaling up: ransomware moved from every intrusion becoming a potential payday toward fewer, larger targets, and the Synnovis attack on an NHS pathology supplier shows the same supplier-compromise logic now taking down entire hospital systems rather than single clinics.
First-order effects
- MSP clients like Arbor Dental lose access to clinical and municipal records through no security decision of their own — the provider's breach is their outage.
Second-order effects
- Small governments and clinics must re-evaluate outsourcing IT altogether, weighing the MSP's cost advantage against becoming a single point of failure shared with dozens of other victims.
Third-order effects
- As ransomware gangs industrialize on multi-million dollar budgets, the sector drifts from advising individual victims to patch toward regulating or hardening the aggregation layer itself — the providers that concentrate hundreds of downstream targets behind one credential.
The trend: Ransomware economics are consolidating around supply-chain compromise, where one breached intermediary delivers many high-value victims at once.