Clinical trials into a COVID-19 vaccine as well as research into other diseases have been delayed following a ransomware attack on a company that provides software to medical firms.

First reported Saturday by The New York Times, the attack targeted eResearchTechnology Inc., a Philadelphia-based company that specializes in clinical software. The attack is said to have been detected two weeks ago when employees discovered they were locked out of their data by ransomware.

As a result of the ransomware attack, companies using ERT’s software were also affected. Among those were IQVIA Inc., a research organization helping managing AstraZeneca plc’s coronavirus vaccine trial, and Bristol Myers Squibb Co., a drug company leading a consortium of companies developing a quick COVID-19 test.

Clinical trial patients were not affected, but researchers were forced to resort to pen and paper to track patients.

How many companies and health organizations have been affected is unknown. The Times noted that the software is used in drug trials across Europe, Asia and North America. Three-quarters of trials that led to drug approvals by the U.S. Food and Drug Administration use ERT software, according to the Times.

The form of malware is unknown. ERT ticked the box of regular ransomware responses — taking its systems offline, calling in outside cybersecurity experts and contacting the U.S. Federal Bureau of Investigation.

Attacks on the healthcare system during the COVID-19 pandemic have been growing as ransomware groups attempt to leverage the serious situation to gain payments. “Healthcare is the richest target for hackers, who are never going to let the proverbial crisis go to waste,” Colin Bastable, chief executive officer of security awareness training firm Lucy Security AG, recently told SiliconANGLE. “The pandemic is going to be a big payday for many cybercriminals and state-backed bad actors.”

The most recent ransomware attack in the medical sector targeted United Health Services Inc., a leading healthcare provider in the U.S. in late September.  Other ransomware attacks include one targeting Fresenius SE & Co. KGaA, Europe’s largest private hospital operator in May. Many attacks targeting hospitals and medical companies have been previously linked to Ryuk ransomware.

While not directly related to COVID-19, a ransomware attack against a German hospital in September led to the death of a patient, the first death attributed directly to such an attack.

Image: Pixabay