Universal Health Services (UHS), one of the largest U.S. healthcare providers and a Fortune 500 company, was hit by ransomware over the weekend. The full extent of the attack has not yet been determined. Universal Health Services owns and operates acute care hospitals, behavioral health centers, surgical hospitals, ambulatory surgery centers, and radiation therapy centers. The company operates over 400 healthcare facilities in the U.S. and the U.K., employs more than 90,000 people, and provides healthcare services to approximately 3.5 million patients each year.
Universal Health Services hospitals have been operating without internal systems since Sunday morning, according to reports from employees and patients on social media. Some patients have been removed from the hospitals, while emergencies have been transferred to other hospitals, after UHS facilities were unable to perform lab work.
According to Universal Health Services employees, the ransomware attack occurred on the evening of September 26th, at approximately 2:00 a.m. CT. Employees reported that their computers rebooted and then a ransom note appeared on their screens . Later, the computers were shut down and IT staff asked the hospital to keep the systems offline .
ZDNet has confirmed problems with the IT systems of UHS hospitals and care centers located in North Carolina and Texas. Similar problems have been reported in other US states, including Arizona, Florida and California, according to a Reddit thread.
Several users claiming to be employees of Universal Health Services commented on Reddit about the security. In particular, a user named Chickenismurder reported the following: "I work at a UHS facility in Tucson and [EXPLETIVE] is definitely down. They won't even let us turn on the computers for at least 24 hours. We're a psychiatric facility, so no one dies without getting their lab results.
Another user named rebeIduckling also commented on the incident saying the following: "I work in a psychiatric clinic in Philly PA. The nurses told me they asked patients what they were taking for morning medications and then didn't even give them evening medications i.e. they don't have any record of their medications. I had to handwrite my notes from photocopies and look at charts for each treatment goal. It was a nightmare.
Despite initial reports that the entire network , many hospitals denied any problems. The company also issued an official statement admitting that it had been hit by a ransomware attack.
According to reports, the incident was caused by Ryuk ransomware, although there is no evidence to support these claims. Ryuk is a ransomware that was in the “dark” for months, but returned to the threat landscape, causing security incidents that occurred last week.
