Police investigation launched after top cancer surgeon Felix Chan was hacked by a ransomware gang

Police investigation launched after top cancer surgeon Felix Chan was hacked by a ransomware gang and sensitive patient details were leaked online

Leading surgeon Felix Chan in the operating theatre at Liverpool Hospital with a robotic surgical system he uses to perform surgery. Picture: Jonathan Ng

Police are investigating after a ­respected Sydney cancer surgeon was hacked by cyber criminals and sensitive patient details leaked online.

Patients of gynaecological ­oncologist Felix Chan are being contacted after members of the Medusa ransomware gang hacked into his IT systems and ransomed patient data.

The criminals are demanding $US100,000 in cryptocurrency and appear to have leaked data online, including patient names, addresses and letters which show outcomes of tests and procedures.

The group appears to has ­falsely claimed the hack on Professor Chan targeted the Crown Princess Mary Cancer Centre at Westmead Hospital, where some of his ­patients have been treated.

Professor Chan has called in cyber specialists and is notifying patients. “On Monday, May 1, I became aware that IT systems attached to my practice had been impacted by a cyber incident,’’ he said. “In response, I took immediate action to safeguard patients and contain the incident by ­engaging external cyber security experts, actively working with the NSW government, and will continue to engage with other regulators as necessary.

“I understand that this news will be concerning to current and former patients, and I apologise for the distress and uncertainty that patients may be feeling.’’

The attack on a leading cancer specialist and his patients underscores the ruthless nature of cyber gangs, with Medusa targeting a number of schools and healthcare providers globally.

Professor Chan said his “No. 1 priority is the ongoing medical care and support of patients’’.

“Disruption to patient care has been minimal,’’ he said. “Cyber ­security specialists are working around the clock to ensure that the practice’s systems are secure, to determine how this incident began, and to identify patients who may have had their personal information compromised.

“I will continue to provide updated information to our patients, and the broader community, as the investigation continues.’’

A spokeswoman for Professor Chan added: “Where we do ­identify impacted personal information, we will keep the relevant patients informed and comply with all corresponding regulatory obligations.’’

The NSW government said it could not comment as police were now investigating the hack.

NSW Health and the NSW Department of Customer Services, which handles the government’s IT and cyber security, said investigations appeared to show the hack had not impacted any NSW Health or Crown Princess Mary Cancer Centre databases.

NSW Health had deployed monitoring and scanning tools to its systems to identify and investigate unusual activity, the agency said. “No threats have been identified impacting NSW Health systems, NSW Health databases, nor Crown Princess Mary Cancer Centre databases,’’ a spokesman said. “The NSW government identified the incident impacted a third-party entity. The third-party was subject to a criminal ­attack, with data being exfiltrated.

“The safety and security of all NSW Health systems remains of highest importance and is continually monitored and safeguarded.”

Medusa posted evidence of the data it had stolen online on its own blog and set a seven-day deadline for the ransom to be paid.

Cyber researchers Databreaches.net accessed the data on the dark web and identified a “file tree’’ which is said contained 10,000 files.

“From the proof pack provided by the attackers on their leak site, there really can be little doubt that they accessed the hospital’s system,’’ Datatbreaches.net said.

“If one clicks on the link, a popup directs the individual to send $US100,000 ($148,000.00) to a bitcoin address that is ­provided.’’