Cyberattack forces major US healthcare network to divert ambulances from hospitals

Cyberattack forces major US healthcare network to divert ambulances from hospitals

A major US healthcare system said Thursday that it was removing ambulances from “some” of its hospitals following a cyber attack this week.

The cyber attack on Ascension, a nonprofit network based in St. Louis, which includes 140 hospitals in 19 states, also disrupted access to electronic health records, some telephone systems and “various systems used to order certain tests, procedures and medications,” Ascension said in a statement issued Thursday afternoon.

The sprawling health care chain, which also owns 40 senior living facilities, said it would use “downtime procedures for some time,” because of the cyber attack. Downtime procedures are typically when healthcare providers revert to backup processes, including paper records, that allow them to care for patients when computers are down.

Four sources briefed on the investigation told CNN that Ascension suffered a ransomware attack, in which cybercriminals typically try to lock down computers and steal data for extortion. The source said that the type of ransomware used in the hack is known as Black Basta, which hackers have used repeatedly to attack healthcare organizations in recent years. Black Basta, also the name of a broad criminal group that uses ransomware, includes Russian speakers, according to the Department of Health and Human Services.

On Friday, the Center for Health Information Sharing and Analysis, a cyber threat sharing group for large healthcare providers around the world, published an advisory warning that hackers using the Black Basta ransomware “have recently accelerated attacks on the healthcare sector.”

That includes at least two healthcare organizations in Europe and the US that have in the past month “suffered severe operational disruption” due to the Black Basta ransomware,” the adviser said, without naming the healthcare organizations.

News of the Ascension hack broke on Wednesday, and Ascension in the last 24 hours has followed the usual playbook for many American organizations that have been attacked by cybercriminals. Ascension notified federal authorities of the incident, hired leading US cyber security firm Mandiant to recover from the incident and shut down systems to try to contain the incident.

Senior US officials have been in repeated contact with Ascension CEO Joseph Impicciche since the ransomware attack to understand how the hack might affect patient care, two sources familiar with the matter told CNN.

“We actively support our ministries as they continue to provide safe patient care with established downtime protocols and procedures, where our workforce is well trained,” Ascension said in a statement Thursday afternoon.

It’s unclear how many Ascension hospitals sent ambulances to other locations because of the cyber attack. Ascension spokesman Gene Ford did not return calls and emails seeking comment.

It’s just the latest major hacking incident to rock a major US healthcare network and leave US officials scrambling to offer support.

A February ransomware attack on Change Healthcare, a subsidiary of healthcare giant UnitedHealth Group, caused billing disruptions at pharmacies across the US and threatened to put several healthcare providers out of business. A third of Americans may have had their personal data compromised in a hack, UnitedHealth CEO Andrew Witty estimated in testimony to Congress this month. UnitedHealth paid a $22 million ransom to cybercriminals to try to protect patient data, Witty said.

The Change Healthcare hack infuriated US lawmakers and raised questions across the federal government about the vulnerability of America’s health care system to disruptive cyberattacks with cascading effects — questions that the cyberattack on Ascension will do nothing to assuage.