AIIMS ransomware: Hackers did not demand specific amount, says health minister

The hackers who attacked All India Institute of Medical Sciences (AIIMS), Delhi with ransomware did not demand any specific ransom amount, Union minister of state for health and family welfare, Bharati Pravin, said in Parliament on Friday.

Responding to a question seeking details of the ransomware attack on the AIIMS servers on November 23, which crippled digital services at the hospital and risked patient and research data, Pravin said, “No specific amount of ransom was demanded by the hackers though a message was discovered on the server suggesting that it was a cyber attack.”

The minister also said all the data of the hospital’s eHospital network has been retrieved from a backup server.

“The backup server was unaffected. Most of the functions of e-Hospital application like patient registration, appointment, admission and discharge, have been restored two weeks after the cyber attack,” she said.

On November 23, the systems at AIIMS and its centres were corrupted by a ransomware attack, which wiped outpatient and research data from its primary and backup servers.

The Delhi Police’s Intelligence Fusion and Strategic Operations (IFSO) cell have filed a First Information Report invoking sections of cyber terrorism (IT Act, section 66F) against unknown persons.

On November 29, the hospital administration said in a statement that the eHospital data was restored on their servers but the complete sanitation of the network was being done before services could be restored. The process was taking some time due to the volume of data and the large number of servers and computers for the hospital services, the AIIMS administration had said.

AIIMS had started restoring its online services in a phased manner starting from December 6. The first department to revive online operations was the new OPD at the Raj Kumari Amrit Kaur Block. It has taken nearly a month for the hospital to revive most of its online services.

“The National Nodal Agency for responding to cyber security incidents, Indian Computer Emergency Response Team (CERT-In) has ‘Empanelled Information Security Auditing Organisations’ for auditing including vulnerability assessment and penetration testing of the computer systems, networks and applications involving public service delivery, including Ayushman Bharat Digital Mission (ABDM). Immediate measures were taken by AIIMS, Delhi to enhance the security like endpoint hardening, string firewall policies and network segmentation to secure all the data of the institute,” the response said.