Fukushima Medical University: hospital devices caught a WannaCry variant in 2017, and two scans had to be retaken after imaging devices rebooted

1. 2020-12-02

   The hospital disclosed that a past virus infection had forced two radiology images to be retaken. It said it had confirmed no ransom demand and no data leak. [1] [2] [3]

From August 2017, testing devices kept malfunctioning in several departments. The review began in November 2020, when the health ministry asked whether past viruses had ever destroyed medical data. Going back through the incident reports of the time, the hospital found 11 that seemed virus-related, two of which had led to retaking radiology images. [2] [3]

The two retakes were a chest CT during which the control terminal rebooted and the images were not saved, and a chest film reader that restarted by itself and could not read the film. The infection was a variant of the WannaCry ransomware family without the functions that encrypt files or show a ransom note. [1] [3]

The hospital's medical information system is not connected to the internet, so it suspects the malware came in through an outside device such as a staff member's own terminal. At the time, the retakes were not shared among the relevant departments and the hospital believed patients were not harmed, so it did not announce them. It has now explained the case again to the patients and their families and apologized. [1] [3]

Since January 2018, with antivirus software installed and the network monitored, the systems have stayed stable. [3]