FBI warns new variant of ransomware fraud targets hospital, medical device companies in Bay Area

ByStephanie Sierra KGO logo

Tuesday, August 23, 2022

FBI: New ransomware fraud targets hospital, medical device companies

The FBI is sounding the alarm to Zeppelin, a new form of ransomware targeting hospital and medical device companies in the Bay Area.

SAN FRANCISCO (KGO) -- The FBI and federal cybersecurity officials are sounding the alarm to a new form of ransomware that is targeting hospital and medical device companies in the Bay Area.

Ransomware

Ransomware is a type of malware that threatens to publish victim's personal data or block access to it unless a ransom is paid.

"I use the word criminal very deliberately here," said Joseph Oregon, the cybersecurity chief for the Cybersecurity and Infrastructure Security Agency, or CISA. "These are criminal organizations."

The new threat

Federal investigators say this ransomware fraud is advancing with a new variant called Zeppelin. It's a type of malware that criminals use to target businesses and large corporations.

"There are hundreds of ransomware variants out there and right now Zeppelin is top of mind," said Elvis Chan, an assistant special agent in charge with the FBI. "They like to target companies in the healthcare sector, small community hospitals, larger hospitals, and medical device companies."

Zeppelin ransomware first surfaced in 2019 but is now becoming more prevalent. Chan says it was most recently detected in late June.

VIDEO: Scammers hack into Bay Area victims' phones accessing photos, camera and location in crypto fraud

A new cryptocurrency scam circulating the Bay Area is haunting victims with a new threat - taking control of their mobile device.

Here's how it works

Investigators say scammers will spend weeks trying to hack into their victim's computer networks. In some cases, they'll find a glitch in your computer software that gives them access to your personal data and use it to blackmail you. Or victims will get an email, also known as a phishing attempt, threatening their company has been hacked and if the ransom isn't paid, confidential files will be exposed. The payment is usually through digital currency like Bitcoin.

"This is not something you can pay your way out of," said Oregon.

Bottom line - never pay the ransom. Investigators say if you do, you're twice as likely to be hit with another cyberattack within six months.

"In fact, a recent survey showed that 80% of businesses that paid a ransomware were also hit again," said Oregon.

One recent victim of the Zelle scam is a San Francisco man who says the imposters knew all of his banking information, leading him into the trap.

The FBI reports most of the criminal organizations behind the ransomware attacks are operating overseas - some even traced to cyber espionage groups in China and Russia.

So what can you do to protect yourself?