A US tech company's former cybersecurity executive has pleaded guilty to a 2018 incident in which he deliberately launched online attacks on two hospitals in order to drum up the company’s business.
According to court documents, Vikas Singla, a former chief operating officer of Atlanta-based cybersecurity firm Securolytics, hacked two hospitals in Georgia, disrupting their phone and network printer services.
Singla is said to have knowingly transmitted a command that resulted in an unauthorized modification to the configuration template for the ASCOM phone system at Gwinnett Medical Center's Duluth hospital campus.
As a result, all of the Duluth hospital's ASCOM phones that were connected to the phone system during Singla's transmission were rendered inoperable, and more than 200 ASCOM handset devices were taken offline.
Those ASCOM phones were used by Duluth hospital staff, including doctors and nurses, for internal communication, including for “code blue” emergencies. They were also used to place calls outside of the hospital, the court documents said.
Singla also obtained the personal information of more than 300 patients and sent a command that resulted in the printing of a file named Baidu.txt that caused more than 200 printers at Gwinnett's Duluth and Lawrenceville hospital campuses to print information relating to the name, birthdate and sex of patients, obtained without authorization from the digitizer, interspersed with the message “WE OWN YOU.”
After the hacks, Singla began emailing prospective clients advertising his company’s services, citing the two incidents as a growing cybersecurity threat.
Vikas Singla was arrested in 2021 and charged with 17 counts of intentional damage to a protected computer and one count of obtaining information from a protected computer. Under the plea deal, Singla has agreed to pay $818,000 in restitution to the medical center and its insurance company for costs associated with the incident. In exchange, prosecutors will recommend to the court that Singla be 57 months of probation, including home detention. His sentencing is scheduled for February 15, 2024.
