Lurie Children's Hospital in Chicago is still working to restore its computer systems over a week after a cyberattack shut down its network.
What happened?
Lurie Children's Hospital in Chicago has been dealing with a cybersecurity incident that began on January 31, causing the shutdown of its computer systems. Despite the hospital remaining operational, the outage has disrupted email, phone, and electronic systems, making tasks like scheduling appointments and accessing medical records difficult. While emergency admissions are unaffected, some patients and doctors are experiencing challenges accessing electronic records. The hospital publicly acknowledged the cybersecurity nature of the incident on February 4. Lurie has not disclosed details about the attack or whether a ransom has been demanded. As a response, a call center was established for patients unable to contact the hospital through regular channels.
See also: The Joint Commission releases guidance on cyberattack response
What was said?
“We recognize the frustration of not having clarity on when this will be resolved,” Lurie said in a statement on its website. “Our investigation remains ongoing and we are working around the clock to resolve this matter.”
HHS Deputy Secretary Andrea Palm told CNN that rural hospitals and other financially challenged facilities need help investing in technology and security practices “to assist them with keeping up with cyber threats.”
In the know
Attacks on healthcare infrastructure are a rising concern that have become increasingly common. This is after St. Margaret’s Health Illinois closed in June 2023, partly due to a cyberattack in 2021. The cyberattack disrupted their computer systems for months, hindering the hospital's ability to process insurance claims.
Furthermore, a cyberattack on Thanksgiving Day 2023 in East Texas redirected ambulances. It affected hospitals in New Jersey, New Mexico, and Oklahoma. These hospitals, which had to reroute ambulances, are either fully or partially owned by Ardent Health Services, a Tennessee-based company with ownership stakes in more than two dozen hospitals across five states.
See also: Why do cyberattacks happen?
Why it matters
The incident reflects a broader trend of cyberattacks targeting healthcare facilities. The attacks can be traced to the lack of safe cybersecurity practices in rural healthcare organizations, which can disrupt services, compromise patient data security, and even force closures.
See also:
FAQs
What are the most common types of cyberattacks?
The most common types of cyberattacks include phishing, malware, ransomware, credential stuffing, zero-day exploits, man-in-the-middle (MitM) attacks, and distributed denial of service (DDoS) attacks.
Go deeper: Types of cyber threats
What are the potential consequences of a successful cyberattack?
A cyberattack can threaten HIPAA compliance, leading to severe consequences beyond the healthcare organization's financial well-being and reputation. It can compromise patient confidentiality and impede essential medical services.
Go deeper: What are the penalties for HIPAA violations?
What regulations and compliance standards exist to address cybersecurity concerns?
Healthcare cybersecurity is regulated by the following regulations and compliance standards:
Tshedimoso Makhene
