North Korean charged in ransomware attacks on US hospitals
Kansas City, Kansas — A man who officials say worked for one of North Korea's military intelligence agencies has been indicted for his alleged involvement in a conspiracy to hack American health care providers, federal prosecutors announced Thursday.
A grand jury in Kansas City, Kansas, indicted Rim Jong Hyok, who is accused of laundering ransom money and using the money to fund additional cyberattacks on defense, technology and government entities around the world. The hack on American hospitals on other health care providers disrupted the treatment of patients, officials said.
"While North Korea uses these types of cybercrimes to circumvent international sanctions and fund its political and military ambitions, the impact of these wanton acts have a direct impact on the citizens of Kansas," said Stephen A. Cyrus, an FBI agent based in Kansas City.
Online court records do not list an attorney for Hyok.
Justice Department officials said an attack on a Kansas hospital, which they did not identify, happened in May 2021 when hackers encrypted the medical center's files and servers. The hospital paid about $100,000 in Bitcoin to get its data back.
The department said it recovered that ransom as well as a payment from a Colorado health care provider affected by the same Maui ransomware variant.
The Justice Department has brought multiple criminal cases related to North Korean hacking in recent years, often alleging a profit-driven motive that differentiates the activity from that of hackers in Russia and China.
In 2021, for instance, the department charged three North Korean computer programmers in a broad range of global hacks, including a destructive attack targeting an American movie studio, and in the attempted theft and extortion of more than $1.3 billion from banks and companies.
Investigators said Hyok has been a member of the Andariel Unit of the North Korean government's Reconnaissance General Bureau, a military intelligence agency. Hyok allegedly conspired to use ransomware software to conduct cyberespionage hacks against American hospitals and other government and technology entities in South Korea, and China.