Latest / Tech Talks With Kinsoft / UMMC Ransomware – 35 Clinics Shut Across Mississippi

Transcript

UMMC Ransomware – 35 Clinics Shut Across Mississippi · Tech Talks With Kinsoft

0:00
Imagine you're a nurse in a really busy emergency
0:03
room. You have this critically ill patient, and
0:06
you reach for your tablet to check their life
0:08
-saving medication dosage, and the screen is
0:11
just... Wow. Yeah. Completely locked. A hacker
0:15
is demanding a ransom. And suddenly, you know,
0:18
you are basically practicing medicine in the
0:19
dark ages. It's terrifying, honestly. It really
0:22
is. Welcome to Tech Talks with Kinsoft. I'm so
0:25
glad you're joining us at the table today. We
0:27
are looking at the massive ransomware attack
0:29
that hit the University of Mississippi Medical
0:31
Center, or UMMC. Right, which was just a massive
0:34
event. Huge. This intrusion was detected on Thursday,
0:38
February 19th, 2026. And for this episode, we
0:42
are drawing from detailed reporting from NPR
0:44
alongside some official statements from UMMC
0:48
leadership and also public briefings from the
0:50
FBI. Yeah. And we really want you to understand
0:52
why this matters. I mean, this isn't just an
0:54
abstract IT problem where, you know, someone
0:56
can't print a PDF. It's a direct, literal threat
1:00
to patient care. It really showcases just the
1:03
sheer vulnerability of the digital systems that
1:06
we rely on every single day. to keep people alive.
1:10
Yeah, our mission today isn't just to look at
1:11
the timeline of a hack. We really want to understand
1:14
the cascading failures that happen when a modern
1:17
hospital's digital heartbeat just abruptly stops.
1:21
So, okay, let's unpack this. Let's do it. We
1:23
know the attack hit on February 19th, but it
1:25
didn't just, like, slow down a few administrative
1:28
computers in the billing department. It completely
1:30
paralyzed their epic electronic medical record
1:33
system, the EMR. Which is catastrophic. Right.
1:36
And for those outside of health, care listening
1:39
right now, how fundamental is the EMR to keeping
1:41
a modern hospital running? Oh, it's the absolute
1:43
central nervous system of the entire operation.
1:46
I mean, the EMR isn't just a digital filing cabinet
1:49
where doctors type of their notes at the end
1:51
of a shift. It's way more active than that. Way
1:52
more. It is a highly integrated, totally automated
1:56
ecosystem. So when a doctor inputs a command
1:58
into a tablet, that system, it pings the pharmacy
2:02
database immediately. It cross -references the
2:05
patient's real -time vitals on a completely separate
2:08
server. And it can even automatically calibrate
2:11
the IV drip that's physically attached to the
2:13
patient's arm. Oh, wow. So it's actually controlling
2:15
the hardware. Exactly. It manages the scheduling,
2:18
the supply chain, the lab results, billing, everything.
2:22
If you sever that digital nervous system, the
2:24
physical hospital just immediately loses its
2:27
ability to coordinate. That makes sense. So imagine
2:30
a modern hospital. without its electronic medical
2:33
records it's well it's like a commercial airliner
2:35
suddenly forced to fly with zero instruments
2:38
just completely blind in the clouds that's a
2:41
really good way to put it yeah the engines are
2:43
still running the pilots are still in the seats
2:44
the passengers are all there but you have no
2:47
altitude reading right no radar and zero communication
2:51
with the control tower you are just flying blind
2:54
and hoping you don't hit a mountain and hoping
2:56
is not a great medical strategy No, definitely
2:59
not. And from what the sources show, UMMC realized
3:02
they were flying blind almost immediately. So
3:05
out of an abundance of caution, hospital officials
3:08
made the deliberate choice to take all of their
3:11
systems offline. Like they pulled the plug themselves.
3:14
They did? But wait. If they pull the plug on
3:17
the servers, aren't they basically just doing
3:19
the hacker's job for them, like shutting everything
3:21
down? It definitely seems counterintuitive. I'll
3:24
give you that. But it is standard incident response.
3:27
Yeah. Because. You know, ransomware doesn't just
3:29
hit one computer and stay there. It spreads.
3:32
Exactly. It relies on a mechanism called lateral
3:34
movement. Once the malware breaches the perimeter,
3:38
it basically crawls through the internal network
3:40
looking for attached servers, backup drives,
3:43
any connected medical devices. It wants to encrypt
3:45
as much data as humanly possible. So it's like
3:48
a virus in the body just hunting for new cells
3:50
to infect. Right. So by deliberately taking the
3:53
systems offline and severing the internal network
3:56
connections, the IT... team builds a firewall.
4:00
They are actively trying to trap the malware
4:02
in whatever segment it currently occupies. Oh,
4:04
I see. Yeah. That way they can test and confirm
4:07
the safety of the rest of the systems before
4:09
the infection spreads any further. Which isolates
4:11
the problem, sure, but it creates a massive secondary
4:14
crisis. You are basically inducing a coma to
4:18
save the patient. Yeah. And what's fascinating
4:20
here is the specific language they use to describe
4:23
that exact action. What did they say? Well...
4:26
The UMMC Vice Chancellor for Health Affairs,
4:28
Luann Woodward, gave a statement where she literally
4:31
said, to use a medical phrase, we have stopped
4:34
the bleeding. Man, that is a very apt crossover
4:36
between medical triage and cybersecurity. It
4:39
really is. But let's look at the actual mechanism
4:42
of that analogy for a second. A tourniquet stops
4:45
a patient from bleeding out, but if you leave
4:47
it on too long, you starve the limb of oxygen
4:50
and you risk losing the leg entirely. Yep, tissue
4:52
death. Right. So in this case, isolating the
4:55
network stopped the malicious bleeding, the lateral
4:58
movement of the malware. But it simultaneously
5:00
starved the hospital of operational data it needed
5:03
to actually function. Completely. And Woodward
5:05
even admitted that 24 hours into the event, the
5:08
full extent and scope of the intrusion was still
5:13
not fully understood. And that uncertainty has
5:15
to be the hardest part. You apply the digital
5:17
tourniquet, but you have absolutely no idea how
5:20
deep the wound actually goes or, you know, how
5:23
long you're going to have to keep the blood flow
5:25
restricted. Exactly. You're just waiting and
5:27
hoping. So they pull the plug on the server.
5:28
to save the data. But the second those screens
5:31
go black, the clinical floor is suddenly paralyzed.
5:34
How do they actually treat the patients sitting
5:37
right in front of them? It's a huge cramble.
5:40
According to the NPR report, UMMC's main hospitals
5:42
and their emergency departments, they did manage
5:45
to stay operational. But the collateral damage
5:48
was just immense. It was statewide, too. Yeah,
5:51
they completely halted care at almost all of
5:54
their 35 clinics statewide. We are talking about
5:57
outpatient surgeries, elective procedures, imaging
6:00
like MRIs and CT scans all completely canceled.
6:03
That's what I've trained from the schedule. They
6:05
even had to cancel chemotherapy appointments,
6:07
which, I mean, I understand delaying an elective
6:10
knee surgery, but why completely halt something
6:12
as critical as chemotherapy? Well, it's because
6:15
modern chemotherapy is not just some simple static
6:18
process. It relies so heavily on precision digital
6:22
dosing. What does that mean exactly? A patient's
6:25
required dosage can fluctuate wildly just based
6:28
on their daily blood work and vital signs. In
6:31
a fully functioning hospital, an algorithm analyzes
6:34
those daily lab results and calculates the precise,
6:37
safe mixture of these highly toxic chemicals.
6:40
It's basically poison, right? You're trying to
6:41
kill the cancer without killing the patient.
6:43
Exactly. So if the EMR is down, the pharmacy
6:46
doesn't have immediate access to those shifting
6:48
lab results. And worse, the automated safeguards
6:51
that flag a dangerous dosage miscalculation.
6:54
Those are gone. Oh, wow. Yeah. Administering
6:57
complex chemotherapy totally blind is just simply
7:00
too risky. The liability and the danger to the
7:02
patient is too high. That makes a lot of sense,
7:04
but it just highlights a brutal reality. The
7:07
system isolation forces these administrators
7:09
into making impossible triage decisions. However,
7:12
looking at the sources, there was one vital operational
7:16
exception that really stands out. The dialysis
7:18
clinics. Yes. While almost all of the 35 clinics
7:21
were shut down, the kidney dialysis clinics remained
7:24
open. Why did dialysis make the cut when chemotherapy
7:27
didn't? It really comes down to the immediate
7:31
biological mechanics of the two treatments. If
7:34
you delay a chemo session by a few days, I mean,
7:36
it's incredibly stressful. Right, and detrimental
7:39
to the long -term plan. Yes, but the patient
7:42
is unlikely to experience a fatal crisis that
7:44
specific afternoon. Dialysis is fundamentally
7:47
different. The patient's kidneys have failed.
7:49
Their blood is being artificially filtered by
7:52
a machine. So there's no natural backup system
7:54
in their body at all. None. If you skip a critical
7:57
dialysis appointment, toxic waste products and
8:00
excess fluid build up in the bloodstream incredibly
8:02
rapidly. Like within hours. Within a matter of
8:04
hours or maybe days, yeah. That buildup can trigger
8:08
cardiac arrest or severe pulmonary edema. So
8:11
UMMC had to draw a hard line based on immediate
8:14
acute mortality risks and say, no matter what,
8:17
we have to keep this specific service running
8:19
even in a total system blackout. Which brings
8:22
up the logistical nightmare of the emergency
8:24
rooms and the ongoing care that didn't get canceled.
8:27
The sources noted that staff had to revert to
8:29
pen and paper downtime procedures. The dreaded
8:32
downtime procedures. Now, I hear pen and paper
8:35
and I picture like an old school doctor with
8:37
a clipboard. Sounds kind of quaint, but. What
8:40
is the actual operational bottleneck here? Why
8:43
does writing things down cause such a massive
8:45
failure in a modern hospital? The bottleneck
8:48
is just the physical speed of information transfer.
8:51
Okay. I mean, in a digital environment, the friction
8:53
of communication is practically zero. It's instant.
8:56
Right. A doctor orders a medication and the software
8:59
instantly cross -references the patient's chart
9:01
for allergies. It checks for negative interactions
9:04
with other drugs. It then immediately pings the
9:07
pharmacy. The pharmacist fills it, scans a barcode,
9:10
and the nurse scans the patient's wristband to
9:13
verify the match before giving the drug. And
9:15
that whole process takes, what, a few seconds?
9:17
The entire validation process takes seconds,
9:19
yeah. But on paper, you lose all of those automated
9:23
safety nets. Entirely. A doctor handwrites the
9:26
order. Someone physically has to walk that piece
9:29
of paper down to the pharmacy, which might be
9:31
on a completely different floor or even a different
9:33
wing of the building. Just burning time. Right.
9:35
And then the pharmacist has to manually check
9:38
massive physical reference books to ensure there
9:42
are no drug interactions. And here is the truly
9:45
dangerous part. OK. Because the digital patient
9:47
history is locked, the pharmacist is relying
9:50
purely on the patient's memory of what they are
9:53
allergic to. Oh, man. And if the patient is unconscious
9:56
or confused or simply doesn't remember the exact
9:59
name of their blood pressure medication, you
10:02
are basically rolling the dice. Exactly. Not
10:04
to mention the classic medical trope of misreading
10:07
handwriting. If a nurse misreads a hastily written
10:10
10 milligrams as 100 milligrams and the safety
10:14
software isn't there to throw a red flag. I mean,
10:17
that is a catastrophic human error. It happens
10:20
so easily too. You are taking a high -speed precision
10:23
operation and forcing it to run on a physical
10:26
infrastructure that simply doesn't exist anymore.
10:28
Hospitals today aren't built with the pneumatic
10:30
tube systems or the massive clerical staffing
10:33
levels they had back in 1990 to support paper
10:35
charting. Exactly. The architecture of a modern
10:38
hospital is designed for data packets, not paper
10:41
flow. So when you force a 2026 medical staff
10:44
to use 1990s workflows in a building optimized
10:47
for Wi -Fi, everything just slows to an absolute
10:50
crawl. And dealing with these paper records and
10:52
this sort of slow motion medicine was only ever
10:54
meant to be a temporary failsafe. But the duration
10:57
of the specific outage was brutal. Nine days.
11:00
Yeah, the clinics stayed closed for roughly nine
11:03
days, finally reopening around March 2, 2026.
11:06
In the tech world, a nine -day server outage
11:09
is a major headache. But in a statewide health
11:12
care network, nine days of canceled surgeries
11:14
and delayed diagnoses is a massive public health
11:17
event. It's a disaster. They obviously had to
11:20
bring in outside help to deal with the root cause,
11:22
which shifts our focus to the investigation and
11:25
the recovery phase. Yeah, UMMC definitely didn't
11:28
try to handle this. in isolation. They worked
11:30
directly with federal authorities, specifically
11:33
CISA, the Cybersecurity and Infrastructure Security
11:36
Agency, and the FBI. Bringing in the heavy hitters.
11:39
Oh, yeah. The FBI special agent in charge of
11:41
the Jackson, Mississippi, field office, Robert
11:44
Eickhoff, was actually quoted in the reporting.
11:46
He noted that the Bureau was surging resources,
11:49
both locally and nationally, to restore patient
11:51
care. Let's translate that phrase, surging resources.
11:54
What does that practically look like when the
11:56
FBI gets involved in a hospital hack? I imagine
11:58
they aren't just sending a couple of agents in
12:00
suits to look at servers, right? Oh, far from
12:03
it. When the FBI surges resources into a cyber
12:05
incident like this, they are deploying specialized
12:08
cyber action teams. Cyber action teams? Yeah.
12:12
These are highly trained units that include forensic
12:15
analysts, malware reverse engineers, and network
12:18
defense specialists. Their first priority, as
12:22
Eikhoff stated, is assisting the medical center
12:24
in getting systems back online safely. But simultaneously,
12:28
they are actively hunting for the attackers.
12:30
And how do they actually do that? Like when the
12:32
sources say the FBI is analyzing a malware signature,
12:36
are we talking about the digital fingerprint
12:38
of the code? How does the FBI use that to figure
12:41
out which hacker group is responsible? A malware
12:44
signature is exactly that. It's a unique digital
12:46
fingerprint. Because ransomware code isn't usually
12:49
built from scratch for every single attack. They
12:51
reuse code. Yeah, hacker syndicates reuse specific
12:54
blocks as code, specific encryption algorithms,
12:56
and even specific communication protocols. So
12:59
the FBI's analysts will isolate the malware found
13:02
on UMMC servers and compare its signature against
13:05
a global database of known cyber threats. Oh,
13:08
that makes sense. If the code matches the signature
13:10
of a known ransomware gang. The FBI suddenly
13:14
knows a lot about their adversary. They know
13:16
the gang's typical negotiation tactics, what
13:18
vulnerabilities they usually exploit to gain
13:21
entry, and most importantly, if there's an existing
13:24
known flaw in their encryption that can be used
13:27
to unlock the data without paying. It's like
13:30
trying to find the master key to a hotel where
13:32
the locks change every five seconds. Very much
13:35
so. But here's where it gets really interesting,
13:37
though. Woodward, the vice chancellor, confirmed
13:40
at a press conference that hospital officials
13:43
had actually communicated with the attackers.
13:45
Yeah, they did. Hold on a second. Law enforcement
13:47
usually operates on a strict policy of we don't
13:50
negotiate with extortionists. Why on earth would
13:53
a hospital open a back channel with the very
13:56
people who just paralyzed their entire operation?
13:59
Doesn't that just invite further exploitation?
14:01
If we connect this to the bigger picture of.
14:04
ransomware economics, communicating with the
14:07
attackers is a very deliberate, high stakes tactical
14:10
move. And, you know, doesn't necessarily mean
14:13
they're negotiating a payout. So why do it? There
14:15
are a few core operational reasons to establish
14:18
that communication, which is usually done via
14:20
a secure anonymous channel on the dark web. The
14:24
most critical reason is demanding proof of life.
14:27
Proof of life. Like a kidnapping protocol. How
14:30
does that work with digital files? I mean, how
14:33
do you even verify a decryption key without accidentally
14:36
triggering more malware and making the whole
14:38
infection worse? It's handled through a highly
14:40
controlled technical process called sandboxing.
14:43
Sandboxing. OK. Yeah. The hospital needs proof
14:46
that the attackers actually possess a working
14:48
decryption key and proof that the files aren't
14:51
permanently corrupted. So the hospital's IT team.
14:55
often working alongside those FBI specialists
14:57
we talked about, will provide the attackers with
14:59
a few encrypted low -value files. So they basically
15:02
test them. Exactly. The attackers decrypt them
15:05
and send them back. The IT team then opens those
15:08
return files in a sandbox, which is a completely
15:10
isolated virtual environment that has absolutely
15:13
no connection to the broader network. That's
15:15
smart. If the files open cleanly, they have verified
15:17
the proof of life without risking further infection.
15:20
And I imagine opening that channel also buys
15:22
the investigation time. Like every hour the hackers
15:25
think a negotiation is happening or that the
15:28
hospital is considering paying the ransom is
15:30
an hour the FBI has to reverse engineer the malware
15:33
or trace the server logs to find the entry point.
15:36
Precisely. It is essentially a stalling tactic.
15:39
It gives the internal tech teams time to comb
15:41
through their offline backups to see if they
15:43
can rebuild the network from scratch without
15:45
needing the attacker's key at all. Wow. But looking
15:48
at the sources we have from NPR and the official
15:50
statements, it's really crucial to note what
15:53
remains unconfirmed here. Right. There's a lot
15:55
we don't know. Exactly. At the time these reports
15:57
were published, the sources did not explicitly
15:59
state whether a ransom was ultimately paid. Furthermore,
16:03
the full scope of the intrusion was still under
16:05
investigation. It was completely unclear if sensitive
16:08
patient information like medical histories, social
16:11
security numbers or billing data had been officially
16:14
stolen or exfiltrated out of the network. before
16:17
the encryption locked it down. And that lack
16:19
of confirmation represents the secondary trauma
16:22
of a cyber attack. What do you mean by secondary
16:24
trauma? Well, the primary trauma is the operational
16:27
shutdown, right? The canceled surgeries and the
16:29
nine days of clinical paralysis. The secondary
16:32
trauma is the long -tail privacy threat. Hackers
16:34
often engage in double extortion. They lock the
16:37
systems, A &D steal the data. Exactly. They lock
16:40
your systems to halt your operations, but they
16:42
also steal the data and threaten to publish it
16:44
online if you don't pay. For the patients of
16:47
UMMC, the uncertainty of whether their most intimate
16:49
health details were compromised is just an agonizing
16:53
position to be in. Yeah, I can't even imagine.
16:55
So what does this all mean? We've looked at the
16:57
timeline, the transition to paper workflows,
16:59
the closure of 35 clinics, the dialysis exception,
17:02
and the FBI surging resources to analyze malware
17:05
signatures. We've covered a lot. We have. And
17:08
if we pull all of these threads together, I think
17:10
this discussion really highlights a fundamental
17:12
shift in how we need to view technology. First,
17:15
it exposes the absolute fragility of our healthcare
17:19
infrastructure. We've built this incredible,
17:21
highly efficient system that can deliver life
17:24
-saving care with pinpoint accuracy, but we've
17:27
built it on an API architecture that can be paralyzed
17:29
by a single malicious intrusion. It's a house
17:32
of cards. It really is. Second, it proves the
17:35
absolute necessity of analog survival skills.
17:38
A hospital's ability to revert to pen and paper
17:41
isn't just, you know, an administrative backup
17:43
plan. It is a critical life -saving operational
17:46
requirement. And finally, it cements the... reality
17:49
that ransomware is no longer just a data privacy
17:52
issue or a financial headache for corporate IT.
17:54
It is a direct operational threat to human safety.
17:58
It's literally a weapon that shuts down chemo
18:00
wards and forces doctors to fly blind. It forces
18:03
a complete reevaluation of what constitutes critical
18:05
infrastructure in the modern era. And it leaves
18:08
me with a thought that I find genuinely concerning
18:10
as we look toward the future. Well, we just spent
18:12
a lot of time discussing the immense friction
18:14
of reverting to paper charts and how modern hospitals
18:17
aren't architecturally designed for it. But at
18:21
least today, in 2026, there are still senior
18:24
doctors and nurses on staff who remember the
18:26
pre -digital days. Right, people who trained
18:29
on paper. Exactly. They remember how to cross
18:32
-reference physical pharmacy books and manage
18:34
floor operations manually. As our medical tools,
18:37
our AI diagnostics, and our robotic surgeries
18:40
become even more advanced and entirely reliant
18:42
on cloud architecture, what happens a decade
18:45
from now? What happens when a hospital is hit
18:48
by ransomware and returning to pen and paper
18:50
is no longer practically possible because the
18:53
new generation of medical professionals were
18:55
never trained on analog systems to begin with?
18:57
That is a chilling thought. If the analog safety
18:59
net rots away because we simply forgot how to
19:01
use it, that is a vulnerability that no software
19:04
patch or FBI cyber action team can ever fix.
19:07
No, they can't. It's something every industry
19:09
needs to be thinking about as we push further
19:11
into this hyper -connected age. You know, if
19:14
today's discussion got you thinking about the
19:16
vulnerabilities in your own network architecture,
19:18
or if you are wondering how your own operational
19:21
safety nets would hold up under pressure, Don't
19:23
wait for a crisis to find out where your blind
19:25
spots are. Thank you. Safe and sorry? Exactly.
19:28
Visit www .kinsoft .com .au to discuss your security
19:33
and IT needs. You really want to build and test
19:36
those safety nets before you actually have to
19:37
fall into them. Thank you so much for joining
19:39
us at the table today for Tech Talks with Kinsoft,
19:41
and we'll catch you on the next one.