Heart surgery device maker's security bypassed, data encrypted and stolen

A manufacturer of devices used in heart surgeries says it's dealing with "a cybersecurity incident" that bears all the hallmarks of a ransomware attack. Artivion, which is listed on the New York Stock Exchange, said the incident took place on November 21 and "involved the acquisition and encryption of files." In plain terms, …

[Anonymous Coward]

"Sounds like th-aorta get this sorted quickly"

That was a good pun. I expect the comments section will respond with jibes about heartless criminals and other comments in the same vein...

[Korev]

Re: "Sounds like th-aorta get this sorted quickly"

Bloody hell that was a good one!

[Korev]

Re: "Sounds like th-aorta get this sorted quickly"

> I expect the comments section will respond with jibes about heartless criminals and other comments in the same vein...

This pun was a work of artery

[ItWasn'tMe]

Re: "Sounds like th-aorta get this sorted quickly"

I suspect it may bypass many.

[Blazde]

Re: "Sounds like th-aorta get this sorted quickly"

A truly veinous crime. Low-lifes like this really make my blood boil.

[Wally Dug]

Re: "Sounds like th-aorta get this sorted quickly"

Is this story:

A Negative

B Positive

O For Goodness' Sakes

or

AB Undecided

[Anonymous Coward]

Re: "Sounds like th-aorta get this sorted quickly"

Hopefully it will end with some arrests of the non-cardiac variety

[Stanley Toolset]

Re: "Sounds like th-aorta get this sorted quickly"

Let's hope they rhesuscitate this story if there are future developments.

[The Oncoming Scorn]

Re: "Sounds like th-aorta get this sorted quickly"

I imagine there will be discussion in chambers, val-ve wait for cops to make arrests.

[Anonymous Coward]

Re: "Sounds like th-aorta get this sorted quickly"

I hope they'd kept on top of their Auricle patching.

[Sam not the Viking]

Re: "Sounds like th-aorta get this sorted quickly"

This isn't something to jugular about.

Thicker than water ----->

[Fruit and Nutcase]

Re: "Sounds like th-aorta get this sorted quickly"

Dicky Ticker[Security]

[Jim Willsher]

As the proud owner/recipient of a new aortic valve last year, I can vouch for how good they are, and to hear about a company that's providing healthcare getting attacked makes my blood boil, it's totally heartless.

[Anonymous Coward]

How was it delivered? In an Aorticulated truck?

[A random security guy]

$90m+/quarter revenue is ripe for ransomware

It is sheer negligence to not have a DRP. Maybe they had one but never tested it? Maybe it was just a show DRP?

[Ken Shabby]

You lot just don’t miss a beat.

[Anonymous Coward]

phew

At least it wasn't the bluetooth implanted defib maker, I have in my chest.

that was close! I can unwrap the foil.

[Bebu sa Ware]

The subed an Igor(ina)?

"Th[a]orta get thith thorted quickly."

The companies side hustle: "Offers a wide range of cryogenically preserved cardiac and vascular allografts – donor tissues that are preserved and later thawed for use in surgeries" sounds like Igors 'R' Us, Überwald.

[Sherrie Ludwig]

I don't know if this would be feasible

Can some person familiar with databases figure out a way to "salt" the data with a computer version of a land mine? A record looking like any other innocuous entry that could be activated either by reading without some special code or routine buried in the legitimate data user's programs to deactivate it, or is time-set to "detonate" without receiving regular "not yet" signals from that legitimate data user? The result to be either the deletion or scrambling of all the records to render them useless, or for maximum effect, wiping any programs that tried to access the data?

I am thinking of the dye packs that sometimes foil bank robbers, which could be set to deliver nastier things than pink dye if one really wanted to discourage crime...

[Anonymous Coward]

Re: I don't know if this would be feasible

Not feasible for various reasons, including:

- Kill switches may be illegal in in some jurisdictions

- The "wiping any programs" part puts you into malware territory

- Risk of being accidently (or deliberately) triggered and having to explain yourself to your customer after wiping their production system