Lurie Children's Hospital of Chicago confirmed Feb. 8 that is the victim of a cyberattack by a "known criminal threat actor."
The hospital took its internet and phone systems offline Jan. 31, switching to paper records and setting up a call center. Patients' family members have been unable to call or email the hospital directly since then or check their MyChart patient portals.
"We did this in an effort to protect the information of our patients, workforce and organization at large," Chief Medical Officer Marcelo Malakooti, MD, said at a Feb. 8 press conference covered by Chicago media. "We can now confirm that our network was accessed by a known criminal threat actor."
Lurie Children's locations have remained open throughout, though patients' family members have posted on social media about appointments and procedures having to be rescheduled.
"Our top priority remains providing safe, quality care to patients and the communities we serve," said Brian Stahulak, DNP, RN, chief clinical and nursing officer of Lurie Children's. "We appreciate the patience of our families and our patients that we serve during this time as we bring our systems back online."
Hospital officials did not give a timeline for when its internet and phones would be restored or confirm whether the event is ransomware, where hackers steal or encrypt data then demand payment. Some ransomware groups have claimed that children's hospitals are off-limits, but similar IT outages at health systems in the past have turned out to be ransomware. Those attacks typically lead to about three weeks of downtime, according to data company Statista.
Lurie Children's said it is working with law enforcement, including the FBI, as well as external cybersecurity experts.
"FBI Chicago is aware of the recent cybersecurity incident affecting Lurie Children's Hospital and is utilizing all available investigative tools and resources to provide assistance," an FBI spokesperson emailed Becker's. "As always, our attention remains on ensuring the safety of our citizens and our nation's critical infrastructure. There is no additional information available for release at this time."
Hackers continue to target the healthcare industry because of the value of patient data and the importance of the sector. In 2023, healthcare data breaches hit a record high while health system ransomware attacks nearly doubled.