Health care entities continue to face a barrage of attacks from cyber criminals, and it is widely reported that the health care industry is getting hit more frequently than any other industry. Ransomware is the name of the game for these attackers in all industries, including health care.
Unfortunately, what is being touted as one of the largest, if not the largest ransomware attacks against a health care entity in 2020, occurred last week against Universal Health Services (UHS), a Fortune 500 company with more than 400 facilities in the U.S. and the United Kingdom. It is believed that the ransomware attack involved the Ryuk strain, which is linked to Russian cybercriminals.
Following the attack, which occurred over a weekend, UHS reportedly took all of its networks down and had to re-route some patients to other facilities. Since not all of UHS’s computers were able to be used, providers were forced to resort to paper. A ransomware attack such as this is extremely disruptive to patient care. Ransomware attacks are designed to be disruptive, anda disruption to to life-or-death patient care is especially concerning.
UHS has publicly stated that no patient or employee data were compromised in the attack and it is using its contingent operations plan. This response demonstrates the importance of having a contingent operations plan in place and testing it to make sure it works.