AIIMS server attack originated from China, services back on track: Reports – Times of India

Weeks after All India Institute of Medical Sciences (AIIMS) servers were hit by a ransomware attack, reports cite government sources as saying that the hack originated from China. Meanwhile, the government announced that data of lakhs of patients has been retrieved.
“AIIMS Delhi server attack was by the Chinese, FIR details that the attack had originated from China. Of 100 servers (40 physical and 60 virtual), five physical servers were successfully infiltrated by the hackers. The damage would have been far worse but is now contained. Data in the five servers have been successfully retrieved now,” ANI cited a source from the Ministry of Health and Family Welfare (MoHFW) as saying.
AIIMS Delhi first reported the ransomware attack on November 23. A case of extortion and cyber terrorism was registered by the Intelligence Fusion and Strategic Operations (IFSO) unit of the Delhi Police two days later.

Soon after the attack, appointments, billing and sharing of reports with patients and within departments were moved to manual mode.
Other agencies including CERT-In, Delhi cybercrime special cell, Indian Cyber Crime Coordination Centre, Intelligence Bureau, Central Bureau of Investigation, National Investigation Agency, etc. have been investigating the incident.
Last week, Minister of State for IT Rajeev Chandrasekhar said that the attack on AIIMS was a deliberate and targeted effort. “I can’t comment on that as it is a subject matter of an investigation by the NIA…It is pretty clear that it is a deliberate and targeted effort…a ransomware attack on AIIMS’ system… and [the] NIA is investigating it,” he said.
Police denied Rs 200 crore ransom demand
Police later denied reports which claimed that hackers asked for Rs 200 crore in cryptocurrency as ransom to restore the system and decrypt the data. Being a premier medical institute, AIIMS has data of lakhs of patients, including top political leaders, bureaucrats and judges.
AIIMS cyberattack issue rocks parliament
The AIIMS ransomware issue was raised in Parliament earlier this week. Senior Congress leader Shashi Tharoor called for an investigation. “The origin, intent and extent of the attack remain unclear,” the MP said in the Lok Sabha.