New Delhi: The attack on the computer system of the All India Institute of Medical Sciences in Delhi originated from China, government sources today said, assuring that the data — details of lakhs of patients at the premier hospital — has now been retrieved.
"The server attack was by the Chinese; the probe found that it originated from China," a top source told NDTV.
"Of the 100 servers — 40 physical and 60 virtual — five physical servers were infiltrated by the hackers. The damage could have been far worse but is now contained. Data in the five servers has been successfully retrieved," a source further said.
The system glitched first on November 23, and a case of extortion and cyber terrorism was registered by the Intelligence Fusion and Strategic Operations (IFSO) unit of the Delhi Police two days later. Police have, however, denied reports that hackers asked for Rs 200 crore in cryptocurrency as ransom to restore the system.
From the system of appointments to the billing and sharing of reports with patients and between departments, almost all services are online at the institute, thus were affected. Additional staff were deployed as it switched to manual mode, going totally offline during the probe even though not all servers were hit.
Patient data theft is at the nub of the attack. Every year, around 38 lakh patients, including top political leaders, bureaucrats and judges, get treated at AIIMS. Top intelligence and anti-terror agencies, besides IT emergency teams, worked the case as all 5,000-odd computers and the servers were scanned.
The issue came up in Parliament two days ago, when senior Congress leader Shashi Tharoor called for a thorough investigation, and measures to ensure no repeat. "The origin, intent and extent of the attack remain unclear," the MP from Thiruvananthapuram had said in the Lok Sabha.
The possibility of this being a "hostile cross-border attack" is a grave concern, Mr Tharoor stressed.
"It also reflects the weak data protection safeguards in our country especially by government institutions," he further said, as per news agency PTI.
Citing the proposed law on personal data protection, he criticised the government for "doing away with" a special category of sensitive personal data, including health data, that required stringent safeguards as per the 2019 draft.