Cyber Incident Victim: eResearch Technology
Date:
Sep 2020
Location:
United States of America
Summary
A ransomware attack targeted a technology firm specializing in clinical trial services, disrupting COVID-19 vaccine and treatment research by forcing trial researchers to manually record data after electronic systems were taken offline. The incident impacted multiple organizations, including a major pharmaceutical company leading a COVID-19 testing alliance and a research firm assisting with vaccine trials, slowing progress but not destroying data due to pre-existing backups. The victim contained the attack, reported it to law enforcement, and began restoring systems without disclosing ransom details or attributing the incident to specific threat actors.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On September 20, 2020, eResearch Technology (ERT), a Philadelphia-based clinical services provider specializing in electronic patient-reported outcomes (ePRO) for global drug trials, suffered a ransomware attack. The company immediately took its systems offline as a precaution upon discovering the incident, disrupting access to critical clinical trial data across Asia, Europe, and North America. Researchers conducting COVID-19 trials for tests, treatments, and vaccines were forced to revert to manual pen-and-paper tracking methods after losing electronic access to ERT’s platforms. While no trials were permanently ruined, the attack caused significant delays in ongoing studies. Among the affected organizations was IQVIA, a contract research organization managing AstraZeneca’s COVID-19 vaccine trial, and Bristol Myers Squibb, which was leading an alliance developing rapid COVID-19 tests. ERT’s pre-existing data backups mitigated potential data loss, though the company declined to disclose the total number of impacted trials or whether any ransom demand was paid. The FBI was notified of the attack, but no attribution to a specific ransomware group was confirmed.
ERT began restoring its systems by October 2, 2020, as confirmed by Vice President of Marketing Drew Bustos, who stated the incident had been contained. The company emphasized its role in supporting 50% of all FDA drug approvals since 2013 but did not specify which trials or therapeutic areas were most affected by the disruption. No patient data compromise was reported, and the primary operational consequence remained the temporary slowdown of research workflows due to manual data collection. The attack highlighted vulnerabilities in clinical trial infrastructure during the pandemic, with Accedian’s cybersecurity VP Michael Rezek noting the broader trend of escalating breaches across industries. ERT’s recovery efforts focused on reactivating systems while maintaining procedural integrity for ongoing trials.