Major hospital system hit with cyberattack, potentially largest in U.S. history

https://www.nbcnews.com/tech/security/cyberattack-hits-major-u-s-hospital-system-n1241254

Sept. 28, 2020, 1:07 PM EDT / Updated Sept. 28, 2020, 4:04 PM EDT
By Kevin Collier

A major hospital chain has been hit by what appears to be one of the largest medical cyberattacks in United States history.

Computer systems for Universal Health Services, which has more than 400 locations, primarily in the U.S., began to fail over the weekend, and some hospitals have had to resort to filing patient information with pen and paper, according to multiple people familiar with the situation.

Universal Health Services did not immediately respond to requests for comment, but posted a statement to its website that its company-wide network “is currently offline, due to an IT security issue. One person familiar with the company’s response efforts who was not authorized to speak to the press said that the attack “looks and smells like ransomware.”

Ransomware is a type of malicious software that spreads across computer networks, encrypting files and demanding payment for a key to decrypt them. It’s become a common tactic for hackers, though attacks of this scale against medical facilities aren’t common. A patient died after a ransomware attack against a German hospital in early September required her to be moved to a different hospital, leading to speculation that it may be the first known death from ransomware.

•••••

While many patient charts at that facility are on paper, medication information is maintained online, though it’s backed up at the end of each day, the nurse said.

•••••

Kenneth White, a computer security engineer with more than a decade of experience working with hospital networks, said that the delays caused by ransomware attacks can have dire consequences for patients.

“When nurses and physicians can't access labs, radiology or cardiology reports, that can dramatically slow down treatment, and in extreme cases, force re-routing for critical care to other treatment centers," he said. "When these systems go down, there is the very real possibility that people can die."