Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Blue Origin to fly again as space tourism struggles to get off the ground

Why this company’s biggest fans turned against it

These ISIS news anchors are AI fakes. Their propaganda is real.

The problem with diversity statements — and what to do about them

Russia shows resilience. There is more to do for Ukraine.

Trump promises tax cuts and fewer rules. CEOs shouldn’t fall for it.

Kyle Finnegan’s rare hiccup helps Phillies to a 4-3 win in 10 innings

Joey Gallo returns, but Nats endure another quiet offensive night

Walter Johnson’s jersey from 1920 showdown with Babe Ruth sold at auction

Would you eat this weird sandwich? Barry Enderwick would. 

She finished chemo then got a medical degree: ‘The dream is real now’

Puppy abandoned with heart-rending note is adopted, named Minerva

Carolyn Hax: Friends say to break other plans to avoid offending new man

Ask Amy: Should my husband get a say in what I do with my inheritance?

Ask Amy: Can’t a single woman eat alone without interruption?

How Jim Jordan tried to connect the dots on Biden’s $8 million book deal

Biden’s false claim that inflation was 9 percent when he took office

Did Obamacare ‘massively’ increase the cost of health care?

The other side of Punta Cana: A crackdown on Haitians

Top White House aide to meet Netanyahu, who is under political pressure

Live updates: Rescuers struggle to find helicopter carrying Iranian president

In photos: The 149th running of the Preakness Stakes

Book Tour: At home with Amor Towles

Gov. Doug Burgum speaks in support of Trump

‘Never Trump?’ ‘Never Biden’ voters might loom larger.

Lawyer preparation suggests Trump won’t testify in New York trial

The world’s coolest hotels want to tell you a story

6 Airbnb red flags to spot before you make a booking mistake

Flying budget airlines might not be as cheap as it seems

US President Joe Biden departure

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

Healthy living, including food, fitness, longevity and mental health

See alerts for Health and Wellness developments

Health & wellness

Tips on living better delivered every Thursday

Well+Being newsletter

Health alerts

Health & Science alerts

Michael S. Williamson

Ascension, one of the largest health systems in the United States, said Thursday that it was struck by a cyberattack that knocked patient record systems offline and forced medical staff to log care on paper, the latest hack to underscore the vulnerability of American’s health-care system to cyber intrusions.

The nonprofit chain said it detected the hack Wednesday and took immediate steps. In the direct aftermath, emergency crews diverted patients to other hospitals while staffers described manual workarounds in interviews.

Electronic patient charts, the core system for the flow of care,<b> </b>were among systems affected, said Ascension, which operates<b> </b>140 hospitals in 19 states.

In addition, the company said late Thursday that MyChart — a portal for patients to see their records and message providers — was unavailable, along with some phone services and systems for ordering tests, procedures and medications. Some elective procedures and appointments have been delayed, the company said, and it directed patients to bring notes on their symptoms and a list of medications with prescription numbers to appointments.

For several hospitals, Ascension said it has instructed emergency medical services to divert patients to other health-care facilities “to ensure emergency cases are triaged immediately.” The health system doesn’t have a timeline for restoring services, it said.

Earlier in the day, Ascension said it was investigating which records were compromised. “Should we determine that any sensitive information was affected, we will notify and support those individuals in accordance with all relevant regulatory and legal guidelines,” it said.

Nurses at Ascension hospitals said the hack disabled a variety of their electronic services, most crucially access to patients’ electronic health records.

Robin Buckner, a nurse at Ascension Saint Agnes Hospital in Baltimore, said she had to talk with doctors by phone or see them in person to get patients’ medical histories before placing intravenous lines. “I’m sure there was a little delay in care,” she said. “There’s no doubt about it.”

At Ascension Seton Medical Center in Austin, staff couldn’t use many of their glucometers — a device that measures blood-sugar levels — because they work by scanning a patient’s wristband to identify them, said Kristine Kittelson, a nurse who works in a postpartum unit.

Now that wristbands are being handwritten, she and her colleagues have had to share just a few glucometers that didn’t rely on the electronic system, she said.

At Ascension Via Christi St. Joseph in Wichita, Carol Samsel noticed things were off Wednesday morning when she couldn’t order food for patients and the pager and emergency-code system weren’t working as usual.

Charting patient care on paper makes everything take longer, but “our patients are being take care of and are safe,” said Samsel, who like Kittelson and Bucker, is a member of the union National Nurses United.

In Pensacola, Fla., Ascension Sacred Heart asked first responders to take patients to other area hospitals Wednesday afternoon, a request known as a “bypass,” said Davis Wood, spokesperson for Escambia County’s public-safety services. The bypass has since been lifted, Wood said Thursday, and emergency responders have resumed taking patients to the hospital.

Health industry security experts said the attack bore similarities to past breaches by Black Basta, a successor to the Russian Conti gang that is notorious for exacting ransom and then demanding more money not to publish sensitive data, a technique known as double extortion.

Ascension didn’t respond to emailed questions or say whether the attack involved <a href="https://www.washingtonpost.com/business/2021/05/12/ransomware-attack/" target="_blank" class="contextual_link">ransomware</a>.

The Catholic-affiliated Ascension, <a href="https://www.beckershospitalreview.com/rankings-and-ratings/100-largest-hospitals-and-health-systems-in-the-us-2023.html" target=_blank>among</a> the five largest networks in the United States by number of hospitals, is headquartered in St. Louis. It reported total revenue of $28.3 billion in 2023.

The hack comes as government and health-care officials focus renewed attention to cybersecurity in the wake of the <a href="https://www.washingtonpost.com/business/2024/03/03/change-health-care-hack-hospitals/" target=_blank>hacking of Change Healthcare</a>, a subsidiary of UnitedHealth Group that is responsible for processing a vast amount of medical claims nationwide.

The cyberattack and ensuing outage disrupted operations across the country’s pharmacies, hospitals and medical practices, preventing them from getting paid and leaving consumers unable to use coupons they rely on to afford prescription drugs.

UnitedHealth Group’s chief executive, Andrew Witty, <a href="https://www.washingtonpost.com/business/2024/05/01/united-health-hack-ceo-congress-change-healthcare/" target=_blank>disclosed last month</a> in a Senate hearing that it paid $22 million in bitcoin to hackers who targeted subsidiary Change Healthcare and shut down medical billing systems across the country.

The vulnerability and UnitedHealth’s response came under intense criticism from lawmakers. In that hack, the criminals accessed computers using compromised credentials, entering through a system that did not require multifactor authentication.

Health-care providers largely have been able to blunt direct impacts to patient care over the course of the Change Healthcare hack, even as they’ve taken out loans and resorted to filing medical claims on paper. The Ascension hack, though smaller in scope, impacted systems with a direct bearing on care.

Ascension said it had turned to a third-party contractor, Mandiant, to help it investigate and work on restoring service. It said it has notified other businesses that interact with its computers so that they can take steps to protect their own systems, which often means disconnecting.

“Our care teams are trained for these kinds of disruptions and have initiated procedures to ensure patient care delivery continues to be safe and as minimally impacted as possible,” Ascension said.

The Department of Health and Human Services “is aware of a cyber incident involving Ascension Health and is in communication with Ascension Leadership to understand and assess their efforts to minimize any disruptions to patient care,” HHS spokesperson Samira Burns said in a statement. Burns added that the incident underscores “the urgency of strengthening cybersecurity resiliency” in health care, pointing to the <a href="https://hphcyber.hhs.gov/performance-goals.html" target=_blank>agency’s voluntary cybersecurity goals</a> as a guide to how organizations can protect themselves.

But the voluntary nature of security measures is being debated as the numbers of incidents increase.

Hackers in recent years increasingly have <a href="https://www.washingtonpost.com/technology/2024/03/19/cybersecurity-healthcare-hack-solutions/" target=_blank>targeted U.S. medical systems</a> with ransomware, which involves infiltrating an organization’s network and using malicious code to lock up its data. The FBI’s internet Crime Complaint Center received reports of 249 ransomware attacks on health-care infrastructure last year, the most of any sector it tracked, according to an <a href="https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf" target=_blank>annual summary </a>released in March.

More ransomware attackers than in previous years are devoting resources to developing sophisticated attacks against larger targets, in hopes of obtaining a bigger ransom, government and cybersecurity officials said. This includes spending more time once inside a target to steal data, instead of just encrypting it.

The average “dwell time” inside ransomware victims has increased from two days to six, security firm Mandiant said this week at an annual forum in San Francisco on cybersecurity, the RSA Conference. Because so many targets pay, the gangs have more to invest in attacks, said Robert Lipovsky, principal threat researcher at security firm ESET.

“It is an uneven fight,” Lipovsky said in an interview Thursday, though the extent of the impact varies depending on the quality of hospitals’ data backups and how segmented their systems are. The more separation, the better, experts said.

“It has to do with the state of cyber resilience that the hospital is in,” Lipovsky said. “At many, it is not very good.”

The White House is actively developing “mandatory minimum” cybersecurity standards for hospitals, deputy national security adviser Anne Neuberger said at the conference. She said officials had been urging multiple sectors to adopt multifactor authentication instead of relying on passwords, comparing some hospital security failures to car owners leaving keys on the seat with the door unlocked.

Megan Stifel, chief strategy officer at the nonprofit Institute for Security and Technology, said she agreed with Neuberger that voluntary codes were not enough. “We chose not to take a regulatory approach, and we’re now paying the price,” she said in an interview.

The American Hospital Association has said it supports voluntary cybersecurity goals but criticized mandatory measures. The organization says requirements like those <a href="https://www.hhs.gov/sites/default/files/fy-2025-budget-in-brief.pdf" target=_blank>proposed</a> by the Biden administration would penalize hospitals that don’t meet certain standards, even when the vulnerability comes from third-party technologies.

University of Chicago, BA in International Studies

Daniel Gilbert joined The Washington Post in 2022 and writes about the business of medicine. He previously spent seven years as an investigative reporter for the Seattle Times, and before that covered business and energy for the Wall Street Journal.

Daniel Gilbert

Top 10 nonfiction books of 2019, Hudson Booksellers

Top 10 nonfiction books of 2010, Hudson Booksellers

Book of the year finalist in 2003, Investigative Reporters & Editors 

Best in Business awards in 2017 and other years, Society for Advancing Business Editing and Writing

Gerald Loeb Awards finalist in 2017 and other years

Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World

Fatal System Error: The Hunt for the New Crime Lords who are Bringing Down the Internet

All the Rave: The Rise and Fall of Shawn Fanning's Napster

Harvard College, A.B. in English

Joseph Menn joined The Post in 2022 after two decades covering technology for Reuters, the Financial Times and the Los Angeles Times. His books include "Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World" (2019) and "Fatal System Error: The Hunt for the New Crime Lords who are Bringing Down the Internet" (2010). 

Joseph Menn

George Polk Award, 2020

Goldsmith Prize for Investigative Reporting finalist, 2021

University of Pennsylvania, BA in history

Dan Diamond is a national health reporter for The Washington Post. He joined The Post in 2021 after five years at Politico, where he won a George Polk award for investigating the Trump administration's response to the coronavirus pandemic.

Dan Diamond

Health-care giant Ascension says hack is disrupting patient care

the-washington-post

Rural Understaffed Hospitals Get Help From A Virtual ER Staff Via Video

Staff Photographer

The Washington Post

staff

Help Desk

Artificial Intelligence

Internet Culture

Space

Tech Policy

Tech

washpost

prism://prism.query/two-sites,/technology,/politics/powerpost/the-technology-202?limit=20

prism://prism.query/site-articles-only,/business&limit=20

Get a curated selection of 10 of our best stories in your inbox every weekend.

Business

The source for business news and analysis. Covering economic policy, business policy, financial news, economic issues, stock market data, local business, technology and more.