Cyberattack reduces services at Chicago children's hospital

Post Reply New Topic

Chicago’s biggest children’s hospital, Ann & Robert H. Lurie Children’s, has entered its second week of reduced service as it tries to recover from a cyberattack.

Most of the hospital’s internet-connected equipment, including phones, email access and electronic health records, have been offline since the start of the incident, the hospital has said, making it significantly more difficult for parents to stay in touch with their doctors. Many appointments and surgeries are still being honored, the hospital said Monday.

“There is a special place in hell for a person who attacks a children’s hospital and disrupts medical care for thousands of innocent children,” said Deborah Land, whose teenage daughter is a patient at the hospital.

On its website, the hospital said, “Lurie Children’s is actively responding to a cybersecurity matter. We are taking this very seriously, are investigating with the support of leading experts, and are working in collaboration with law enforcement agencies. As part of our response to this matter, we have proactively taken network systems offline which is currently impacting our phone, email and electronic systems.”

A spokesperson for the hospital told NBC News by text message that Lurie Children’s took its systems offline Jan. 31, meaning that it has been operating at significantly reduced capability for more than a week.

Experts say the incident is consistent with a ransomware attack. Ransomware hackers, often located in Russia, where they’re safe from extradition to other countries, frequently take over hospital networks and demand payment in cryptocurrency.

Land said that the outage has caused an infuriating runaround. Her daughter needs bloodwork completed for an appointment next week. But the digital order to get that bloodwork is inaccessible because Lurie’s systems are down, and despite repeated calls to the hospital’s emergency call center and a visit to the hospital, no one has given her a paper order for the bloodwork.

Her daughter is on a controlled substance and needs to refill her prescription every week, she said. Because Lurie patients currently don’t have access to MyChart, a popular medical program that lets patients message with doctors and doctors to write prescriptions, Land had to scramble to find another doctor to renew her daughter’s prescription.

“I still have not been able to reach the specialist. There’s no phone number at the hospital I can call. I cannot email. I cannot MyChart,” Lurie said. She said that one hospital staffer called her from a private number to tell her that a virtual appointment had been canceled, but that meant there was no way to call back and reschedule.

“It’s a total mess. The hospital’s not telling anybody anything,” she said.

It’s unclear when Lurie Childrens will resume full functionality.

Despite several Western government initiatives against ransomware, the problem has continued to worsen. Last year saw more ransomware attacks on U.S. health care networks than ever before, according to the cybersecurity company Emsisoft. A report published Wednesday found that victims had paid a record $1 billion in 2023, enshrining it as an especially lucrative type of cybercrime.

Last year, an Illinois hospital closed in part because of the financial strain of dealing with a ransomware attack.