The ECS-CERT today announced that it had discovered how cyber attackers had managed to change test results at the Wirths Clinic that allowed at least 13 employees of the Bump and Grind Casino in Atlantic City, NJ to return to work last month while infected with COVID-19. “The hackers were able to reprogram the Robotron PrAnalysator because of access that they gained through the barcode reader that read patient information on the sample vials being tested at the clinic,” Immanuel C. Securitage told reporters.
Erich Mielke, spokesman for Robotron, said that their BCLesegerät barcode reader had a feature that allowed the use of barcodes to program the communications that the device had with various Robotron clinical devices. “In a clinic laboratory environment, it is easier to use the barcode on a sample vial to provide instructions for the processing of that sample rather than requiring a technician to input the instructions at the keyboard; it increases lab thru put,” Mielke explained.
The Clinic uses the Robotron BCLesegerät barcode reader to read and enter patient testing data into the clinic database and to provide tracking data to the PrAnalysator, according to the Clinic spokesperson, Aribert Heim. “We were not aware of the feature of the reader that allowed barcodes to be used in programming the reader.” Heim told reporters.
Jerry Catena, a spokesman for the Casino told reporters that all testing supplies had been provided by the Clinic. “Wirths Clinic provided the supplies and a doctor to supervise the sample collection activities,” Catena explained; “Our first aid teams, all certified EMTs, did the actual sampling. We have no idea how this could have happened.”
“We have confirmed that the labels on the sample tubes were changed on about half of the samples collected at the Casino,” Clark Stanley from the Federal Drug Administration told reporters. Half of those changed labels would have caused a report of no virus and no COVID-19 antibodies, the remainder would have resulted in a no virus and positive for antibodies reporting.
The Federal Bureau of Inquiry is still investigating the
incident, according to Johnathan Quest. “We have determined that the substitute
labels were not printed on a Robotron label printer,” Quest told reporters,
“We are continuing to look at the forensics to try to determine where they were printed.”
A total of 250 COVID-19 cases have now been traced back to the Casino’s initial opening weekend.