A ransomware attack appears to have taken down all IT systems at Universal Health Services (UHS), which operates 400 hospitals and behavioral health facilities in the US and the UK.
UHS employees began reporting problems on Monday via Reddit; the attack has been shutting down computers at various hospitals, forcing them to turn away patients, they say.
One UHS employee based in Arizona told PCMag that the disruption has been blamed on ransomware infecting hospital systems. “Everything is down. No access to any computer at all," the employee said. The hospital has only recently managed to restore the phone system.
“I believe we are turning patients away,” the employee added. “We have been doing everything on paper charts. What gets me is we had no downtime protocols in place. It’s all been improv.”
BleepingComputer reports that a notorious ransomware strain known as Ryuk appears to be behind the attack, which has encrypted computers across the UHS network, making them impossible to access.
Ransomware can often be delivered via phishing emails or by exploiting vulnerabilities in a company's IT system. The hackers behind the assault will then post a ransom note, demanding the victims pay up in Bitcoin.
The attack on UHS could put patient lives at risk, which is what many security experts have long feared might occur after an attack on a major hospital system. UHS operates 328 inpatient behavioral healthcare facilities, one surgical hospital, six “ambulatory” surgery centers, and 14 “freestanding emergency departments.”
In a statement, UHS confirmed IT systems were down across the company’s hospitals. But for now, UHS is attributing the problems to “an IT security issue.” The healthcare provider also says patient safety isn't at risk.
“In the meantime, our facilities are using their established back-up processes including offline documentation methods. Patient care continues to be delivered safely and effectively,” UHS said. "No patient or employee data appears to have been accessed, copied or otherwise compromised."
According to a UHS employee on Reddit, the attack occurred on Sunday morning at 2 a.m. “I was sitting at my computer charting when all of this started. It was surreal and definitely seemed to propagate over the network,” the user wrote. “All machines in my department are Dell Win10 boxes. When the attack happened multiple antivirus programs were disabled by the attack and hard drives just lit up with activity. After 1 min or so of this the computers logged out and shut down.”