Lurie Children's Hospital network outage continues as hospital responds to 'cybersecurity matter'
Patient call center established for urgent requests
CHICAGO (WLS) -- A network outage at Lurie Children's Hospital has impacted phones, email, internet service and even medical equipment that relies on computers as the hospital investigates a "cyber security matter."
The cyber security matter has affected business at the hospital for two days. Lurie said its main hospital, outpatient centers and primary care offices are impacted.
"Think about the traditional means of warfare, guns and people you don't do that anymore, you just have the key board and computer and keyboard and you can launch an attack from anywhere," said Maurice Dawson, director at the IIT Center for Cyber Security and Education.
Officials with Lurie said they are working quickly to try and resolve this matter and get everything back online.
In a statement, Lurie said, "Lurie Children's is actively responding to a cybersecurity matter. We are taking this very seriously, are investigating with the support of leading experts, and are working in collaboration with law enforcement agencies. As part of our response to this matter, we have taken network systems offline."
"We recognize the concern and inconvenience the systems outage may cause our patient families and community providers, and are working diligently to resolve this matter as quickly and effectively as possible."
The incident has impacted phones, emails, internet service, some elective surgeries and procedures even had to be canceled.
A call center has been established to address needs including non-urgent patient requests, care questions, information regarding scheduled patient appointments, and patient prescription refill requests.
The Lurie Children's call center can be reaching by calling 1-800-543-7362, and is operational Monday to Friday from 8 a.m. to 8 p.m., Saturday from 8 a.m. to 5 p.m., and Sunday from 8 a.m. to noon.
Patients should visit luriechildrens.org for the most up to date information about their operations.
Cyber security experts said cyberattacks are on the rise and will continue to increase. Hospitals used to be off limits, but not anymore; experts say they've become top targets because they don't typically have the budget or staff to prevent sophisticated attacks and it's profitable.
"Hospitals are a treasure trove of private data. Hospitals have so much information about us or medical histories, financial documents, insurance," said Ray Klump, cybersecurity expert.
"The hackers are using the information that the steal and then they start using that information against patients because health care information is much more rich than just credit info," said Pete Nicoletti of Check Point Software.
An I-Team review of federal data found attacks on Illinois healthcare computers has more than doubled from 12 incidents in 2022 to 27 incidents in 2023, affecting nearly 3.5 million people. St. Anthony Hospital on the Southwest Side confirmed it had also been attacked seven weeks ago.
"This is a rash and epidemic of attacks that are happening," said U.S. Rep. Raja Krishnamoorthi (D-Schaumburg). "The threat actors are North Korea, Iran, the Chinese Communist Party, of course, the Russians have perfected the art of these cyberattacks."
Lurie shut down its system Wednesday, and the hospital continues to work with law enforcement, including the FBI, on the investigation. Experts say recovering from cyberattacks can take several days.
"It's system restoration; they have to figure out the attack, where the attack is, what are the affected systems," Dawson said.
Experts say hackers often succeed through a system's email.
"Email is a sewage pipe and unfortunately, people click on things and unless you have quite a sophisticated email protection scheme people are going to click on links," said Nicoletti.
Lurie was previously hit-nearly a year ago, when a third party security breach compromised thousands of patient records. Now there are questions about whether that was a scouting mission.
"I mean reconnaissance is part of a hackers repertoire. And if they can figure out what are your weaknesses they're gonna exploit them in the future," Klump said. "So it could be third party vendors, it could be disgruntled employees
Meanwhile doctors and nurses are charting and writing prescriptions on pen and paper, and test results are delayed.
