Sources: US Department of Health and Human Services suffered a cyberattack on its computer system Sunday night, apparently aimed at slowing coronavirus response
and most importantly, it looks like the attempt failed https://www.bloomberg.com/... Dan Primack / @danprimack : There are terrible people, and then there are the WORST people. https://twitter.com/...
Bloomberg
Context & Ripple Effects
At the very start of the US pandemic response, sources reported that HHS's computer system was hit Sunday night by an attack apparently aimed at slowing the coronavirus effort — and that the attempt appears to have failed. The incident sits on a longer arc of federal health-system intrusions: two years earlier, a system interacting with HealthCare.gov was hacked, exposing data on roughly 75,000 people.
What makes this story durable is what came after: officials later attributed the March 2020 attack to a state-level actor and described it as the largest DDoS the US government had ever experienced, while the private healthcare side of the sector went on to absorb far more damaging blows.
First-order effects
HHS staff working the early coronavirus response faced degraded systems at the exact moment federal coordination mattered most, though reporting indicates the slowdown attempt did not succeed.
Second-order effects
The episode foreshadowed where attackers went next: UnitedHealth's technology unit was knocked out for days by BlackCat ransomware, disrupting pharmacies nationwide, and Ascension's ~140 hospitals saw systems down indefinitely after a similar strike.
Third-order effects
Attribution arriving nearly four years later shows state-level actors probing US health infrastructure during a crisis, pushing health agencies and hospital operators toward being treated as national-security targets rather than ordinary IT environments.
The trend: US healthcare infrastructure — from federal agencies like HHS to hospital and claims networks — is becoming a standing target for both state-level and criminal cyber operations, with each major incident raising the baseline for resilience expectations.
////BREAKING: U.S. Health and Human Services Department suffered a cyber-attack on its computer system Sunday night during the nation's response to the coronavirus pandemic. The attack appears to have been intended to slow the agency's systems down. Story w @shiramstein soon
NEWS: The National Security Council's tweet on Sunday night was related to HHS hacking and release of disinformation, per sources. The govt realized Sunday that there had been a cyber intrusion and false information was circulating. Story with @shiramstein https://www.bloomberg.c…
There are people out there who see this outbreak as an opportunity to hurt us. That's why it's so important for Americans to come together during times like this. https://abcnews.go.com/...
Asked about HHS cyber incident in the White House briefing room, Alex Azar says: “We had no penetration into our networks...We had no limitation of our capacity for people to telework...The source of this enhanced activity remains under investigation.” https://www.cyberscoop.com/…
@snlyngaas @shanvav UPDATE: So it looks more and more like this is just some very very odd traffic scans than some sort of cyberattack https://www.cyberscoop.com/...
This is a vulnerable moment: in addition to the public health concerns, we should be prepared for a pummeling of political warfare attacks - cyberattacks, data leaks, disinformation campaigns. Chaos provides opportunities and we will be tested. https://www.bloomberg.com/...
When the president denies the fact that Russia attacked us, and when the Republicans refuse to fund cyber-security, this is what you get: cyberwarfare in the middle of a pandemic. https://www.bloomberg.com/...
Sadly, we live in a world with a very robust disinformation ecosystem. The challenge right now will be to protect us all by disseminating accurate & timely info on what is happening and what we must do but also QUICKLY knocking down knowingly false info with the truth. https://tw…
Ugly: Cyber attack at US Health Agency last night as it was responding to #Coronavirus. Failed to significantly slow HHS system or take data, but it circulated disinformation. https://www.bloomberg.com/...
VERY scant details from Bloomberg right now. Reading between the lines it looks like someone tried to DDOS @HHSGov last night — and most importantly, it looks like the attempt failed https://www.bloomberg.com/...