QST: ransomware on QST Hospital's clinical research systems, caused by an unpatched network device and shared passwords

On 9 July 2024 the National Institutes for Quantum Science and Technology (QST) said ransomware had hit two systems that QST Hospital (Inage, Chiba) runs on a network separate from patient care: J-CROS, a multi-centre clinical research system for heavy-ion therapy, and JROD, a national registry of radiotherapy cases. Staff noticed the problem around 16:00 on 11 January and cut the network at 17:40. The attacker came in through a network device and encrypted files on several servers, making anonymised case records unusable (about 25,000 in J-CROS and 450,000 in JROD). Backups kept the work and patient care going. The causes included network device software that had not been updated and the same password on administrator accounts of several servers. The systems also hold names and affiliations of 24 J-CROS staff at participating institutions and 1,088 JROD doctors and others; no leak has been confirmed.