In what was apparently a Distributed Denial of Service attack (DDoS), Health and Human Services Department computers were hit by unknown cyber-assailants on Sunday night in an attempt to impede the department’s response to the coronavirus pandemic.
Business Insider reports:
An HHS spokesperson confirmed in a statement to Business Insider that it is investigating a “significant increase in activity” on its cyber infrastructure Sunday night, adding that its systems have remained fully operational.
“HHS has an IT infrastructure with risk-based security controls continuously monitored in order to detect and address cybersecurity threats and vulnerabilities,” HHS spokesperson Caitlin Oakley told Business Insider. “Early on while preparing and responding to COVID-19, HHS put extra protections in place. We are coordinating with federal law enforcement and remain vigilant and focused on ensuring the integrity of our IT infrastructure.”
According to Bloomberg, although the attack was unsuccessful, it is being treated as a national security matter:
“We are aware of a cyber incident related to the Health and Human Services computer networks, and the federal government is investigating this incident thoroughly,” John Ullyot, a spokesman for the National Security Council, said in a statement. “HHS and federal government cybersecurity professionals are continuously monitoring and taking appropriate actions to secure our federal networks.”
He said “HHS and federal networks are functioning normally at this time.”
Not yet known, or at least not yet made public, is the identity of the attacker. Bloomberg also reports that “while a foreign state is suspected in the attack, the administration hasn’t yet confirmed who it was.” If it was a state actor like China or Russia (just to name two out of many possibilities), an attack like last night’s might be rightly considered an act of war.
Ugly: Cyber attack at US Health Agency last night as it was responding to #Coronavirus.
Failed to significantly slow HHS system or take data, but it circulated disinformation. https://t.co/RPF6gPdaeA
— Joyce Karam (@Joyce_Karam) March 16, 2020
On the disinformation front, it might have been the same hackers spreading fake news via text message concerning a national quarantine. There is no national quarantine.
In real news, the CDC now recommends mass gatherings of 50 or more people to be avoided for eight weeks. That seems wise to me. The quicker we can flatten the coronavirus growth curve, the less serious the pandemic will be. What only feels like overreaction now is exactly the kind of thing that prevents us from dangerous or panicky overreactions later.
We do however have a darkly fascinating situation where our incredible technological achievements also open up new attack vectors for the all-too-creative global terrorist class. Airliners made possible an ever-shrinking world of ever-growing tourism and commerce, but also the attacks of 9/11.
The benefits of modern technology cannot possibly be overstated, but they come with new vulnerabilities. I’ve been saying for weeks now about coronavirus that we need to treat it “seriously, but not hysterically,” and that applies to other threats, too. It also seems to be the exact response from HHS and the NSC to last night’s cyberattack.
Maybe the best news is that, as I wrote earlier today, Americans are fighting this pandemic from the bottom up, not just from the top down. That gives us resilience far beyond any new security measures on the HHS computer network.
Exit Question: If it was a state-level actor behind Sunday night’s HHS attacks, what should our response be?
Join the conversation as a VIP Member