A half year into a pandemic that’s killed almost 600,000 people, the international race for protection from the virus escalated to a treacherous new level with allegations that vaccine development has become a target of Russian cyberattacks.
Vaccine nationalism is already a concern as countries jockey to secure doses of future shots, desperate for a way out of a global crisis that’s slammed their economies.
Science and money have been the main drivers so far, with the US spending billions on deals for experimental shots and other countries trying to keep up. Government reports that Russian intelligence hacked international research centres developing inoculations against Covid-19 add a plot line reminiscent of Cold War spy thrillers.
“The stakes are higher than ever,” David Nides, a health-care cyber specialist at KPMG in Chicago, said in an interview. “There’s a race for a vaccine or a treatment, and the prize is huge for whoever comes out on top.”
Concerns over global access to vaccines have escalated, with Brazil surpassing two million coronavirus infections and India exceeding one million cases. In May, Sanofi chief executive officer Paul Hudson said Americans would likely get the French company’s Covid-19 vaccine before the rest of the world if it proved successful, because the US was first in line to fund its research. Later, Sanofi said its vaccine would be available to everyone.
That prompted other countries and groups like the European Union to try to catch up – mostly by pooling funds for deals of their own or by lobbying for equitable access. There are more than 160 vaccine projects underway at companies and research organisations around the world. China’s president Xi Jinping has pledged to turn any vaccine developed by the country into a global public good – even as the country’s CanSino Biologics Inc has already administered a shot to some Chinese soldiers.
Health-care companies and organisations have long been considered prime targets for cyberattacks, in part because of relatively lax security, a large number of access points and devices that can be penetrated. The value of the information they contain is also coveted. US-based Merck & Co was hit by a ransomware attack in 2017 that affected manufacturing, formulation and packaging.
Attacks on health-care and life-sciences organisations have intensified during the pandemic, with cybercrime in the sector increasing about 300% since May, compared with the same period a year earlier, Nides estimated. Hackers working for the Chinese government are trying to steal research on coronavirus vaccines and treatments from US organisations, the FBI and the Department of Homeland Security warned in May.
Russia hasn’t invested in the scientific infrastructure that would allow it to develop vaccines as quickly as the US, UK, China and other nations, according to Michael Ebert, executive vice president of advisory services at Focal Point Data Risk, a Tampa, Florida-based cybersecurity firm.
The operation, which appeared to quietly steal information rather than locking it up for ransom, shows how desperate Russia is for guidance on how to make vaccines, as well as access, he said.
“I don’t think anyone cares about the IP behind the vaccine,” Ebert said. “They see this as a global issue.”
A Russian military hospital this week discharged the first group of 18 volunteers in a vaccine trial after a 28-day observation period, calling the initial phase a success. That news followed on the heels of an update from US biotech firm Moderna Inc, which reported that its proposed shot produced antibodies against the virus, while The Lancet is expected to provide an update Monday on the vaccine AstraZeneca Plc and the University of Oxford are developing.
The head of the Russian sovereign wealth fund, which is involved in research into a vaccine, dismissed the hacking accusations, which the Kremlin also denied.
“This whole story is an attempt to tarnish the reputation of the Russian vaccine by some of the people who are scared of its success,” Kirill Dmitriev, chief executive officer of the Russian Direct Investment Fund, said in an interview with Times Radio. “Because the Russian vaccine could potentially be the first to the market and it could potentially be the most effective vaccine out there.”
Britain’s National Cyber Security Centre said Thursday that vaccine and therapeutic sectors in multiple countries have been targeted by a group known as APT29, which it said is “almost certainly” part of Russian state intelligence. Security agencies in the US and Canada later issued their own statements backing up the findings.
Ciaran Martin, the head of the NCSC, said in an interview on Nightly News with Lester Holt that there is no evidence the hackers stole data, only that they infiltrated systems.
“It’s deplorable, and we call it out in the strongest possible terms and we are trying to make sure by publicising the technical details that people can defend against it,” Martin said.
Canada’s public safety minister, Bill Blair, said the attack probably didn’t set back the country’s efforts but that it was a reminder to scientists and industries of how much is at stake.
“We remain concerned. Not just the Russians targeting it but other foreign actors as well,” Blair told reporters Thursday in Ottawa. “There are unfortunately people in this world who don’t play by the rules and represent a risk – even a threat – to Canadian interests and to everyone’s interest.”
Criminal groups are exploiting the pandemic crisis with a surge of ransomware attacks on health-care providers and medical facilities, according to cybersecurity experts. Hackers broke into computers at Hammersmith Medicines Research, a London-based company that carries out clinical trials for new medicines, just as the company was in talks with other firms about potentially testing a vaccine.
Oxford said it’s working with UK authorities “to ensure our Covid-19 research has the best possible cyber security and protection”.
Imperial College London, which is also developing a vaccine, said through a spokesman “we take appropriate security measures and have benefited from government advice, including from the National Cyber Security Centre, to provide extra protection around our Covid-19 vaccine work”. – Bloomberg