AIIMS Server Shut Down for 7th Day, Two System Analysts Suspended

AIIMS Servers Compromised

The server of All India Institute of Medical Sciences is still out of service consecutively for the seventh day. The network is currently being inspected before restoring the services like hospital services which include outpatient, in-patient, and laboratories, as they continue to operate in manual mode. 

The restoration process takes some time due to the enormous volume of data and a large number of computers/servers for hospital services. AIIMS is taking cybersecurity measures to deal with the issue. 

Investigation Launched

The Intelligence Fusion and Strategic Operations (IFSO) unit of Delhi police registered a case of extortion and cyber terrorism on November 25. In the process, AIIMS suspended two system analysts on Monday after serving show-cause notices for alleged dereliction of duty. 

As per the official sources, internet services in the hospital are blocked as per the recommendations of the investigating authorities. 

News18 reports, "the CERT-In, the Delhi cybercrime special cell, the Indian Cybercrime Coordination Centre, the Intelligence Bureau, the Central Bureau of Investigation, National Investigation Agency, among others, are investigating the ransomware incident."

According to official sources, the NIC e-Hospital at AIIMS uses 24 servers for various hospital modules and four of these servers were hit with ransomware- primary and secondary database servers of the e-Hospital, and primary application and primary database servers of Laboratory Information System (LIS). 

Current state

Afterward, ransomware was also discovered in the elastic search virtual server 1.4. All compromised servers were separated, as per the sources. Four new servers were brought in, which includes two from external agencies, for restoring e-Hospital apps. 

The databases were restored on these four servers (now scanned) and the data can be accessed. Besides this, four servers of NIC applications were also scanned. Out of these, viruses were discovered in two servers. 

"AIIMS has around 40 physical and 100 virtual servers. Five have shown signs of the virus. These servers are also being set up for scanning and new servers with updated configurations are being purchased as most servers at AIIMS where the end of life/end of support," said a source to News18. 

The antivirus has been installed manually in around 2400 computers.