Iranian hackers targeted Boston Children’s Hospital network in ‘despicable’ cyberattack thwarted by FBI, director says

Boston Children’s Hospital’s computer network missed “one of the most despicable cyberattacks” ever seen thanks to the “quick action” of the FBI, agency officials announced.

Officials received a tip from another intelligence agency last August that the children’s hospital was “about to be targeted” and effectively blocked the attack, FBI Director Christopher A. Wray said.

“In the summer of 2021, hackers sponsored by the Iranian government tried to conduct one of the most despicable cyberattacks I’ve ever seen right here in Boston when they decided to go after Boston Children’s Hospital,” Wray said on Wednesday, speaking at the sixth annual Boston Conference on Cyber Security at Boston College. “Let me just say that again: Boston Children’s Hospital.”

There were ultimately no disruptions to the hospital’s operations last summer.

“Quick actions by everyone involved, especially at the hospital, protected both the network and the sick kids who depend on it,” Wray said.

It wasn’t the first time Boston Children’s has faced cyberattacks, with attempted infiltrations of the hospital’s network being waged in both 2014 and 2019. Wray said following the latest incident, the bureau met with the hospital seven times over 10 days to address the threat and help them plan for and protect themselves from future attacks.

“Children’s and our Boston office already knew each other well — before the attack from Iran — and that made a difference,” he said.

The hospital’s network was disrupted for about a week in 2014 in a high-profile attack launched by hacker Martin Gottesfeld in protest to Boston Children’s handling of the case of Justina Pelletier case, a Connecticut teenager whose divisive custody battle between doctors and her parents over allegations of both medical malpractice and medical child abuse captured headlines.

DCF was awarded custody of Pelletier after Boston Children’s doctors determined symptoms from a supposed mitochondrial disease were actually rooted in psychological issues. The hospital committed her to a psychiatric ward following refusal from her parents, prompting a medical malpractice lawsuit from the family. The hospital was eventually cleared of the allegations.

The FBI’s investigation led to a conviction and 10-year sentence for the hacker in 2019.

The motives for the most recent cyberattack remain unclear, but Wray said it is becoming increasingly common for nations to hire cyber mercenaries to conduct attacks on their behalf.

Related Content: