Alleged Ransomware Attack Disrupts Medical Care at UHS Hospitals Across the US

Universal Health Services (UHS), one of the largest hospital chains in the US, was hit by an apparent cyberattack over the weekend that disrupted IT and phone systems at healthcare facilities in California, Florida, Texas, Arizona and Washington DC.

According to UHS employee reports, the attack occurred on Sunday morning, when various systems in the Emergency Department (ED) began shutting down.

“I was sitting at my computer charting when all of this started,” a UHS employee stated on Reddit. “It was surreal and definitely seemed to propagate over the network. All machines in my department are Dell Win10 boxes. When the attack happened multiple antivirus programs were disabled by the attack and hard drives just lit up with activity. After 1min or so of this the computers logged out and shutdown. When you try to power back on the computers they automatically just shutdown.”

UHS officials described the systems outage as an “IT security issue.”

“The IT Network across Universal Health Services (UHS) facilities is currently offline,” UHS said in a statement on Sept 28. “We implement extensive IT security protocols and are working diligently with our IT security partners to restore IT operations as quickly as possible.”

With IT systems down, nurses and physicians have a hard time delivering medical care and treatments to patients. Employees say staff is forced to work “old school,” using offline documentation methods for charting medication.

“In the meantime, our facilities are using their established back-up processes including offline documentation methods,” UHS added. “Patient care continues to be delivered safely and effectively. No patient or employee data appears to have been accessed, copied or misused.”

Although UHS has yet to confirm the type of malicious attack, the scenario suggests ransomware.

UHS’ systems outage reminds us of the ransomware attack on Düsseldorf University Hospital (UKD). What started as a network disruption forced the hospital to deregister as an emergency care facility and postpone patient appointments. The attack didn’t just inhibit proper medical care. A woman in need of urgent medical admission died after being taken to another city for treatment.