A cyberattack this week disrupted services at the University of Vermont Health Network, with facilities in Vermont and northern New York still experiencing problems as of Friday.  

UVM representatives told the local NBC affiliate that six hospitals were affected by a "significant and ongoing system-wide network issue."

The attack rendered the MyChart Patient Portal – which individuals can use to schedule appointments and access health information, including lab results – unuseable throughout the network.   

"FBI Albany can confirm we are investigating a potential cyberattack at UVM Health, along with our federal, state and local partners. This is an active investigation, and we decline to comment further at this time," said an FBI spokesperson to Healthcare IT News.  

Vermont Public Safety Commissioner Michael Schirling told NBC, "We haven't had a disruption of such a large component of our operational landscape since the beginning of these kinds of events.  

"I think it's fair to characterize this as the most significant we're aware of," Schirling continued.  

WHY IT MATTERS  

According to the most recent update on the UVM website, services were still disrupted at the Central Vermont Medical Center, the Champlain Valley Physicians Hospital and the UVM Medical Center.

The system noted that it was resuming some elective procedures at UVM Medical Center with the hope of resuming them on Friday.  

Schirling told NBC that, while there is no indication patient data was compromised, the possibility cannot be ruled out. Spokespeople did not respond to questions from Healthcare IT News about whether patient information had been breached.  

Although spokespeople also did not comment about the nature of the cyberattack, Check Point Research recently reported a 71% increase in ransomware attacks against the U.S. healthcare sector in October alone.  

"What’s alarming is the sheer investment hackers have made in targeting hospitals this year," said Ekram Ahmed, Check Point spokesperson, in a statement to Healthcare IT News.   

"Hackers are also using more sophisticated techniques such as double-extortion, where ransomware operators threaten to expose compromised data on the dark web if victims do not meet the demands," Ahmed continued.  

THE LARGER TREND

The attack appears to have taken place the same day the FBI released a warning in conjunction with the U.S. Department of Health and Human Services and the Cybersecurity and Infrastructure Security Agency about "increased and imminent" cyberthreats to hospitals.  

The agencies noted the increased strain health systems were facing under the COVID-19 crisis, making them particularly juicy targets.  

"Ransomware attacks on our healthcare system may be the most dangerous cybersecurity threat we’ve ever seen in the United States," said Charles Carmakal, chief technology officer of cybersecurity firm Mandiant, in a press statement. Hospitals in New York and Oregon were also hit with ransomware attacks this week.

ON THE RECORD  

"Hospitals are an attractive and lucrative target for hackers. They see hospitals as among the most vulnerable targets in society, most willing to meet the demands of the ransom, given their inundation with patients, plethora of connected devices and use of older operating systems," said Ahmed.

Kat Jercich is senior editor of Healthcare IT News.
Twitter: @kjercich
Email: kjercich@himss.org
Healthcare IT News is a HIMSS Media publication.