UCSF Ransomware Attack

Summary

The University of California, San Francisco (UCSF) paid a $1.14 million ransom following a NetWalker ransomware attack in June 2020. The attack targeted the School of Medicine’s servers, encrypting crucial academic research data. While patient care and COVID-19 research remained unaffected, UCSF decided to pay the ransom to recover the encrypted data and prevent further data leaks.

Explore the data solution with built-in protection against ransomware TrueNAS.

** Main Story**

Okay, so remember that ransomware attack on UCSF back in June 2020? It was a mess, right? Let’s dive into it, because it’s a great (if scary) example of the challenges institutions face.

The University of California, San Francisco, yeah, UCSF, they got hit hard. Some group called NetWalker, managed to lock up data on their School of Medicine servers. Now, imagine the scramble to deal with that. I remember reading about it at the time and just thinking, ‘Wow, what a nightmare scenario.’ And, of course, the attackers wanted a huge ransom to unlock everything.

The Nitty-Gritty of the Attack

The attack kicked off on June 1st, 2020. NetWalker ransomware wormed its way into the UCSF School of Medicine’s IT systems. You can imagine the panic. Luckily, UCSF’s IT team spotted the intrusion on June 3rd. And immediately, they jumped into action, isolating the affected systems to stop it from spreading even further. Phew! A bullet dodged, somewhat. Importantly, and this is a big deal, patient care wasn’t disrupted, nor was the main campus network or any of the COVID-19 research going on. That’s something, at least.

However, the data they did manage to encrypt held significant value, particularly for UCSF’s academic endeavors. Think research data, sensitive studies, the kind of stuff you can’t just recreate overnight. The attackers, initially, they wanted $3 million. Apparently, they’d done their homework and figured out UCSF could cough that up. But here’s where it gets interesting: negotiations began, and UCSF played hardball. They started with an offer of $780,000. Ultimately, they settled on $1.14 million, paid in Bitcoin. Yeah, that’s still a lot of money, right? UCSF publicly acknowledged the tough call to pay, justifying it by saying the data was crucial for the public good and that the cost of not recovering it could have been even higher.

What We Can Learn From It

This whole thing really shined a spotlight on some critical cybersecurity issues.

• Ransomware is a huge threat: It’s only getting worse, especially for universities and other institutions holding super-sensitive data. NetWalker, they were known for going after orgs they knew could pay big. They were brutal.
• Recovery is a pain, even with the best security: Think about the logistics of recovering from something like this. You can’t just flip a switch. UCSF’s decision to pay, while controversial, shows how vital that data was and how important a speedy recovery was to them.
• Preparation is absolutely key. You have to have a solid plan in place. Regular backups are essential, and you need a clear incident response plan everyone understands. And of course, you need to train your employees, because human error? It’s often the weak link.

What did UCSF do after the attack?

Well, straight away UCSF worked closely with law enforcement, bringing in external cybersecurity experts to investigate the whole sorry mess. And, obviously, they wanted to avoid any reoccurrences. So they tightened up their security, got better at spotting threats, and made sure their staff was properly trained on, you know, how to not click on dodgy links.

Ultimately, the UCSF ransomware attack is a stark warning. It shows that cybercrime isn’t some far-off threat, it’s real, and it’s constantly evolving. But by taking these lessons on board and staying vigilant, we can stand a much better chance of keeping ourselves safe online. Wouldn’t you agree?