It is anything but a normal day at the Ann & Robert Lurie Children’s Hospital of Chicago. Patients are still being treated, but the entire facility is making do without phones, email and computer services after what is being called a “cybersecurity matter.”
“We are taking this very seriously, are investigating with the support of leading experts, and are working in collaboration with law enforcement agencies. As part of our response to this matter, we have taken network systems offline,” the hospital said in a statement Thursday night.
Sources at the FBI say that the agency is aware of a cybersecurity issue affecting Lurie Children’s Hospital, and is providing assistance.
Lurie has established a call center to address the needs of patients' families and community providers. People are urged to call 1-800-543-7362 for questions and concerns, such as non-urgent patient requests, information regarding scheduled appointments and prescription refill requests.
The call center is open from 8 a.m. to 8 p.m. Monday through Friday, 8 a.m. to 5 p.m. on Saturday and 8 a.m. to 12 p.m. on Sunday.
Hospitals have become a favorite target of hackers according to cybersecurity experts. A recent study by Checkpoint Security found that hospitals are third behind education or research systems and government or military systems in the number of attacks launched each week. “They are targeting hospitals because hospitals will pay,” said Pete Nicoletti of Checkpoint.
“There is usually a huge incentive for them to act quickly and work towards paying a ransom,” said John Bromfield of Vistrada Consulting Services. “When lives are in the balance, they have to act quickly,” he said.
Local
Hospitals are targeted bot only because they pay ransom, Nicoletti said, but because their data is valuable to hackers on the dark web because patient data can be sold to hacker who could then stage their own phishing attacks using what appears to be legitimate bilking data from the hospital.
Experts say they are numerous ways hackers can exploit hospital systems, but they are most often targeted by malicious emails. They can also take advantage of connected devices like MRI scanners and heart monitors that don’t have sufficient protections.
Feeling out of the loop? We'll catch you up on the Chicago news you need to know. Sign up for the weekly Chicago Catch-Up newsletter.
Nicoletti said almost every hospital keeps a backup of its data, but recoveries can be a lengthy process. “I like to say that a lot of hospitals are using floppy drives to do back up and then sending it to a stagecoach to a cave somewhere because it takes days and weeks to do recovery,” he said.
As of Friday afternoon, the luriechildrens.org website is still down. “This website is using a security service to protect itself from online attacks,” a statement on the page said.
