According to the government, 1.3 terabytes of data were encrypted in the recent ransomware attack on the All-India Institute of Medical Sciences (AIIMS) information technology network by an unknown threat. On Friday, Mr. Rajeev Chandrasekhar, Minister of State for Electronics and Information Technology, clarified that the information system is managed by AIIMS itself.

Additionally, Dr. Bharati Pravin Pawar, Minister of State for Health, and Family Welfare stated that all the data for e-Hospital has been retrieved from a backup server and restored to new servers. She also added that all the functions of the e-Hospital application, such as patient registration, appointment scheduling, admission, discharge, etc., were restored after two weeks of the attack.

After being informed about the cybersecurity incident, the Indian Computer Emergency Response Team (CERT-In) evaluated the information system. The evaluation showed the servers were compromised in the information technology network of the AIIMS by unknown threat actors due to improper network segmentation, which caused operational disruption due to the non-functionality of critical applications. The preliminary analysis also showed five servers of the AIIMS were affected, and approximately 1.3 terabytes of data were encrypted.

Mr. Chandrasekhar stated that CERT-In, which is mandated to track and monitor cybersecurity incidents in India, had issued a special advisory on security practices to enhance the resilience of health sector entities. The recommendations published in "India Ransomware Report H1-2022" have been communicated to the Health Ministry for sensitizing entities in the health sector regarding the latest cybersecurity threats. The recommendations published in August cover all the latest tactics and techniques of ransomware attackers and ransomware-specific incident response and mitigation measures.