Incident Score: Analysis & Impact (VICRSC1782196273)

In this Rankiteo incident briefing, we review the RSC breach identified under incident ID VICRSC1782196273.

The analysis begins with a detailed overview of RSC's information like the linkedin page: https://www.linkedin.com/company/rsc, the number of followers: 496, the industry type: IT Services and IT Consulting and the number of employees: 255 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 755 and after the incident was 645 with a difference of -110 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on RSC and their customers.

On 10 February 2024, Pitești Children’s Hospital disclosed ransomware issues under the banner "Romanian Hospitals Hit by Massive Ransomware Attack, Forcing Return to Pen and Paper".

On 10 February 2024, a ransomware attack crippled 100 hospitals across Romania, disrupting critical medical systems and forcing staff to revert to pen-and-paper record-keeping.

The disruption is felt across the environment, affecting Hippocrates medical software system, and exposing patient records, lab results, pharmacy logistics, payroll.

In response, teams activated the incident response plan, moved swiftly to contain the threat with measures like disconnected hospitals from the internet, emergency order to halt malware spread, and began remediation that includes restored systems from backups, while recovery efforts such as offline workarounds (Excel spreadsheets, paper records) continue, and stakeholders are being briefed through media coordination.

The case underscores how ongoing, teams are taking away lessons such as The incident underscored vulnerabilities in medical software supply chains and the growing risks of digital dependency in critical infrastructure. The response highlighted the importance of rapid containment, media coordination, and backup reliance, and recommending next steps like Enhance cybersecurity measures for healthcare IT systems, improve supply chain security, and develop robust offline workarounds for critical services, with advisories going out to stakeholders covering Authorities warned about the increasing frequency and severity of ransomware attacks on healthcare institutions.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.