UNITED STATES NEWS

Ransomware attack prompts multistate hospital chain to divert some emergency room patients elsewhere

Nov 28, 2023, 9:21 AM | Updated: 1:32 pm

NASHVILLE, Tenn. (AP) — A ransomware attack has prompted a health care chain that operates 30 hospitals in six states to divert patients from some of its emergency rooms to other hospitals, while putting certain elective procedures on pause, the company announced.

In a statement Monday, Ardent Health Services said the attack occurred Nov. 23 and the company took its network offline, suspending user access to its information technology applications, including the software used to document patient care.

As of midday Tuesday, about half of Ardent’s 25 emergency rooms were still operating on “divert,” meaning the hospitals have asked ambulances to take those needing emergency care to other facilities in their areas, Ardent spokesperson Will Roberts said. Roberts said hospitals nationwide also use divert status sometimes during flu season, COVID surges, natural disasters or a large trauma event.

The company said it could not yet confirm the extent of any patient health or financial information that has been compromised. Ardent says it reported the issue to law enforcement and retained third-party forensic and threat intelligence advisors, while working with cybersecurity specialists to restore IT functions as quickly as possible. There was no timeline yet to resolve the problems.

Ardent, which is based in the Nashville, Tennessee, suburb of Brentwood, owns and operates 30 hospitals and more than 200 care sites with upwards of 1,400 aligned providers in Oklahoma, Texas, New Jersey, New Mexico, Idaho and Kansas.

Each hospital is still providing medical screenings and stabilizing care to patients arriving at emergency rooms, the company said.

In Amarillo, Texas, William Spell said he and his mother have been sick with flu-like symptoms for days but have been unable to see a doctor because of the cyberattack.

Spell, 34, said he tried Sunday night to make an appointment through an online patient portal but could not access it.

“We are trying to figure out other options as to what to do next because we cannot make an appointment with my primary care doctor,” he said Tuesday.

BSA Health System – the Ardent umbrella provider for Spell’s clinic and other facilities in the city – said in a Facebook post that it was working to restore its patient portal and system for video doctor’s visits. Spell said his doctor’s office could not tell him how long the outage might last and advised him and his mother to visit an urgent care clinic.

“That’s just something we cannot do because urgent-cares charge a lot of money just to walk through the door and be seen by a doctor,” Spell said. “There’s no way we can afford that.”

Several hospitals in Albuquerque, New Mexico within Ardent’s Lovelace Health System have continued to divert some patients who need emergency care to other city hospitals, Lovelace spokesperson Whitney Marquez said. They also are rescheduling elective and other non-urgent surgeries.

In Topeka, Kansas, a hospital spokesperson confirmed the attack put the University of Kansas Health System-St. Francis on divert status. Meanwhile, the city’s other hospital, Stormont Vail, saw patient volume began increasing Friday and increased weekend staffing, said Stormont Vail Health spokesperson MollyPatt Eyestone.

There was no immediate claim of responsibility for the attack. Ransomware criminals do not usually admit to an attack unless the victim refuses to pay.

“The attack against Ardent Health is both egregious and quickly becoming the norm,” said Allan Liska, an analyst at the cybersecurity firm Recorded Future. “Stories like patients being turned away from emergency rooms, hospitals being forced to resort to pen and paper for patient care, or hospital personnel unable to access medical records are increasingly common.” He believes the problem is getting worse.

While some groups won’t attack hospitals, “they are greatly outnumbered by those who will and with the number of ransomware groups growing every day, the percentage who won’t attack hospitals is constantly decreasing,” Liska said. “Health care, in general, is an attractive target for these groups because there is a perception that they are more likely to pay, even though the evidence suggests otherwise.” Even when health care providers don’t pay, ransomware groups can sell patient data, Liska added.

A recent global study by the cybersecurity firm Sophos found nearly two-thirds of health care organizations were hit by ransomware attacks in the year ending in March, double the rate from two years earlier but dipping slightly from 2022. Education was the sector most likely to be hit, with attack saturation at 80%.

Increasingly, ransomware gangs steal data before activating data-scrambling malware that paralyzes networks. The threat of making stolen data public is used to extort payments. That data can also be sold online. Sophos found data theft occurred in one in three ransomware attacks on health care organizations.

Analyst Brett Callow at the cybersecurity firm Emsisoft said 25 U.S. health care systems with 290 hospitals were hit last year while this year the number is 36 with 128 hospitals. Not all hospitals within the systems may have been impacted, and not all may have been impacted equally, he said. “Also, improved resilience may have improved recovery times.”

“We’re not in a significantly better position than in previous years, and it may actually be worse,” he said.

“We desperately need to find ways to better protect our hospitals. These incidents put patients lives at risk — especially when ambulances need to be diverted — and the fact that nobody appears to have yet died is partly due to luck, and that luck will eventually run out,” Callow added.

Most ransomware syndicates are run by Russian speakers based in former Soviet states, out of reach of U.S. law enforcement, though some “affiliates” who do the grunt work of infecting targets and negotiating ransoms live in the West, using the syndicates’ software infrastructure and tools.

___

Bleiberg reported from Dallas. Associated Press technology reporter Frank Bajak and writers Heather Hollingsworth in Mission, Kansas, and Susan Montoya Bryan in Albuquerque, New Mexico contributed to this report.

United States News

Musher Dutch Johnson, a kennel manager at The August Foundation for Alaska Racing Dogs, runs a dog ...

Associated Press

Alaska’s Iditarod dogs get neon visibility harnesses after 5 were fatally hit while training

ANCHORAGE, Alaska (AP) — The Iditarod, the annual sled dog race celebrating Alaska’s official state sport, is set to get underway Saturday with a new focus on safety after five dogs died and eight were injured in collisions with snowmobiles while training on shared, multi-use trails. For the first time, mushers who line up for […]

37 minutes ago

FILE - Texas Attorney General Ken Paxton speaks during the Conservative Political Action Conference...

Associated Press

Texas Attorney General Ken Paxton beat impeachment. Now he wants Super Tuesday revenge on his foes

AUSTIN, Texas (AP) — Texas Attorney General Ken Paxton beat impeachment. On Super Tuesday, he wants political revenge. The Republican, who just six months ago was on the brink of removal from office, is charging into Texas’ primaries on a dramatic campaign to oust dozens in his own party. They include rank-and-file legislators, state judges […]

38 minutes ago

Speaker of the House Mike Johnson, R-La., speaks at the Capitol in Washington, Feb. 29, 2024. Short...

Associated Press

Ukrainian troops are rationing ammo. But House Republicans plan to take weeks to consider aid

WASHINGTON (AP) — Ukrainian drones fly without ammunition. Russian artillery unleash deadly volleys from safe positions beyond the range of Kyiv’s troops. Shortages of ammo and supplies are resulting in lost ground to Moscow, U.S. congressional leaders warn, yet the Republican-controlled House has shown little hurry to resupply Ukraine with military aid. Across Washington, officials […]

55 minutes ago

FILE - Registered Republican voters stand in line March 6, 2012, for the caucus event in Rathdrum, ...

Associated Press

Republicans in Idaho, Missouri and Michigan will meet to weigh in on the presidential race

More delegates are up for grabs Saturday as former President Donald Trump looks to get closer to clinching the Republican nomination and former U.N. Ambassador Nikki Haley seeks her first win. Trump, who is especially strong in caucuses, is expected to add to his delegate lead in Republican caucuses in Idaho and Missouri, as well […]

56 minutes ago

FILE - Music fans relax during a break in the entertainment at the Woodstock Music and Arts Fair, A...

Associated Press

Peace, music and memories: As the 1960s fade, historians scramble to capture Woodstock’s voices

BETHEL, N.Y. (AP) — Woodstock didn’t even happen in Woodstock. The fabled music festival, seen as one of the seminal cultural events of the 1960s, took place 60 miles (96.5 kilometers) away in Bethel, New York, an even smaller village than Woodstock. It’s a fitting misnomer for an event that has become as much legend […]

58 minutes ago

***HOLD FOR JEFF MCMURRAY STORY**** Pedestrians cross the street at the intersection of Washington ...

Associated Press

A New Jersey city that limited street parking hasn’t had a traffic death in 7 years

Street parking was already scarce in Hoboken, New Jersey, when the death of an elderly pedestrian spurred city leaders to remove even more spaces in a bid to end traffic fatalities. For seven years now, the city of nearly 60,000 people has reported resounding success: Not a single automobile occupant, pedestrian or bicyclist has died […]

1 hour ago

Sponsored Articles

...

Midwestern University

Midwestern University Clinics: transforming health care in the valley

Midwestern University, long a fixture of comprehensive health care education in the West Valley, is also a recognized leader in community health care.

...

Day & Night Air Conditioning, Heating and Plumbing

Day & Night is looking for the oldest AC in the Valley

Does your air conditioner make weird noises or a burning smell when it starts? If so, you may be due for an AC unit replacement.

...

Fiesta Bowl Foundation

The 51st annual Vrbo Fiesta Bowl Parade is excitingly upon us

The 51st annual Vrbo Fiesta Bowl Parade presented by Lerner & Rowe is upon us! The attraction honors Arizona and the history of the game.

Ransomware attack prompts multistate hospital chain to divert some emergency room patients elsewhere