Chinese hacker behind ransomware attack on MacKay Hospital, others: CIB

Taipei, April 3 (CNA) The Criminal Investigation Bureau (CIB) on Wednesday said it had identified the suspect behind the hacking and attempted extortion of MacKay Memorial Hospital as a 20-year-old Chinese man, but gave little indication as to whether it expected China's government to pursue the case.

Taipei's MacKay Memorial Hospital was hit by a ransomware attack on Feb. 6 by a hacker using the alias "Crazyhunter," which paralyzed the hospital's computer systems and demanded payment in return, Lin Chien-lung (林建隆), head of the CIB's High-Tech Crime Center said at a news conference.

Following the hacking attack, MacKay Hospital reported the breach to Taipei police, who in turn notified the CIB, which set up a joint team with Taipei prosecutors to investigate the case, Lin said.

After the hospital refused to pay the ransom, patient data stolen in the attack was put up for sale in an online forum frequented by hackers on Feb. 28, Lin said.

Officials investigating the case found that "Crazyhunter" had been involved in a total of 11 hacking attacks in Taiwan in February and March, which also victimized other hospitals, schools and listed companies.

By analyzing IP data, hacking techniques and the ransomware used, CIB investigators identified "Crazyhunter" as a 20-year-old employee of a cyber security company in Zhejiang Province, China, surnamed Lo (羅), while also collecting other digital evidence related to his illicit financial flows.

The CIB said Lo had even set up a website on the dark web displaying his hacking targets and how much money he had extorted from them, with the purpose of sowing fear among the Taiwanese public and undermining social order.

As Lo's alleged actions violated several laws, including extortion and offenses against computer security under the Criminal Code, and violations of the Personal Data Protection Act, he was referred to Taipei prosecutors to have a warrant put out for his arrest, the CIB said.

According to the CIB, prosecutors will also use the appropriate cross-strait channels to send evidence of Lo's criminal activity to China's Ministry of Public Security.