Philadelphia-based eResearchTechnology, a company that sells software that is used in clinical trials, including clinical trials of Covid-19 vaccines, was hit with a ransomware attack that has affected several of its clients, including at least one company running Covid-19 vaccine trials. The attack occurred on September 20, 2020 and forced some clinical trial researchers to switch to pen and paper to track their patients. While patient safety was never put at risk, the attack has had an effect on clinical trials and has slowed progress.
IQVIA, the research organization running AstraZeneca’s Covid-19 vaccine trial was one of the organizations affected by the attack, although it is unclear to what extent, if any, the attack affected its Covid-19 vaccine trial. Bristol Myers Squibb, which is leading efforts to develop a rapid test for the virus, was also affected by the ransomware attack. Both firms explained that the effect was limited as they had backups which could be used to recover data. IQVIA issued a statement saying it was unaware of any confidential data related to clinical trials being exfiltrated prior to the use of ransomware to encrypt files.
Following the attack, eResearchTechnology powered down its computer systems and third-party cybersecurity experts were engaged to assist with the investigation and recovery. The Federal Bureau of Investigation was also notified and is investigating the attack. Certain systems have been offline for around 2 weeks, and started to be brought back online on Friday, according to the New York Times. The remainder of its systems are expected to be brought back online in the next few days.
It is unclear which threat group conducted the attack, what ransomware variant was used, and whether the ransom demand was paid for the keys to decrypt files.
eResearchTechnology’s software is extensively used in clinical trials. Last year, around three quarters of all clinical trials that resulted in drug approvals used eResearchTechnology software.
The attack was announced just a few days after Universal Health Services experienced a suspected ransomware attack that affected all of its U.S. locations and forced it to take its systems offline and redirect patients to alternative healthcare providers. Figures from Emsisoft suggest there have been at least 53 ransomware attacks on healthcare providers in the United States so far in 2020. More than 500 hospitals and clinics have been affected by those attacks.
The post Clinical Trial Software Provider Hit with Ransomware Attack appeared first on HIPAA Journal.