Taiwan announces measures to protect hospitals from hackers

Taipei, Aug. 15 (CNA) The Ministry of Digital Affairs (MODA) on Friday announced plans to strengthen cybersecurity resilience in Taiwan's medical sector, following cyberattacks on at least two hospitals earlier this year that were linked to a Chinese hacker.

"Under [ransomware] attacks, we are concerned that hospitals could be paralyzed, posing a major risk to Taiwan, and that personal data within them could also be leaked," MODA Deputy Minister Lin Yi-jing (林宜敬) said at a news conference in Taipei.

To address such challenges, Lin said MODA and the Ministry of Health and Welfare (MOHW) have joined hands to improve cybersecurity in hospitals, which are considered critical infrastructure.

Four measures, including cyber defense drills, talent development, institutional guidance and enhanced inspections, will be implemented to help hospitals defend against cyberattacks, said Tsai Fu-longe (蔡福隆), director-general of MODA's Administration for Cyber Security.

One of the drills highlighted by MODA is an exercise scheduled for the end of 2025 that will invite domestic and foreign white-hat hackers -- experts who hack systems to identify vulnerabilities and alert organizations -- to take part, with a focus on the medical sector.

Eleven hospitals will team up to counter attacks in the drills, with the aim of strengthening their ability to implement protective measures and file reports when facing cyberattacks, Tsai said.

"In the past, hospitals may have handled defense on their own, but such drills can foster closer cooperation between them and help enhance their technical capabilities," he added.

Following a series of attacks by "CrazyHunter" earlier this year, the resilience of Taiwan's medical sector has improved, said Lee Chien-chang (李建璋), head of MOHW's Department of Information Management.

The "CrazyHunter" attack Lee referred to was a ransomware incident that crippled the computer systems of Taipei's MacKay Memorial Hospital in February and Changhua Christian Hospital (CCH) in March, both of which are top-tier medical centers in Taiwan's three-tier hospital classification system.

While no data was leaked from CCH, patient information stolen from MacKay was later put up for sale after the hospital refused to pay the ransom, according to the Criminal Investigation Bureau (CIB).

Lee said that following the two attacks, the MOHW in March issued guidelines for hospitals on responding to ransomware attacks. "Such response guidelines are almost unheard of in other countries," he noted.

With such guidelines, cybersecurity staff will know what to do at any point after an attack, Lee said, including what actions to take within 24, 48 and 72 hours -- starting with containing the damage, identifying the malware and quickly restoring systems.

He added that all medical centers in Taiwan have now installed Endpoint Detection and Response (EDR), a cybersecurity tool absent in most before the two attacks but which helped some computers at MacKay avoid compromise during the February incident.

In April, the CIB said "Crazyhunter" is the alias of a 20-year-old employee of a cybersecurity company in Zhejiang Province, China, surnamed Lo (羅). That revelation has prompted speculation over whether Lo was supported by Chinese authorities to launch the attack.

In response to media questions on the matter, Lee said, "We cannot speculate, but on the surface it is clear that there was indeed a specific commercial ransom demand."

Asked by CNA whether Taiwan's medical sector is now prepared to withstand an attack by hackers backed by Chinese authorities, Lee said the government would never assume "our defenses are impenetrable and that such incidents will not happen again."

He said the focus is on building resilience so that if an attack breaches the system, operations can be restored immediately. "This is what we are working on now," Lee added.