Ascension says personal data may be compromised in cyberattack

Ascension said Wednesday it believes a recent cyberattack may have compromised patient data.

Hackers stole files that may contain protected health information from seven servers used for daily tasks after an employee mistakenly downloaded a "malicious file," Ascension said in a news release.

Related: How providers may be liable in Change Healthcare breach

"We don’t know precisely what data was potentially affected and for which patients," Ascension said in a statement. "We need to conduct a full review of the files that may have been impacted and carefully analyze them. While we have started this process, it is a significant undertaking that will take time."

The health system did not say how long it expects a full investigation to take.

St. Louis-based Ascension, which reported the cyberattack May 8, is offering free credit monitoring and identity theft services to patients and employees. The health system said it has no evidence data was stolen from electronic health records or other clinical systems.

About a month ago, Ascension reported unusual activity on its systems and later confirmed it as a ransomware attack. The nonprofit health system urged business partners to disconnect from its systems and canceled some elective procedures, tests and appointments.

Ascension set a Friday deadline to restore all electronic health records. As of Wednesday, it had restored the main technology for health records in Alabama, Florida, Illinois, Kansas, Maryland, Oklahoma, Tennessee, Wisconsin and parts of Texas and Indiana. Facilities in three states and Washington, D.C., are waiting to come back online.

Operations in Arkansas, Louisiana and Missouri were not interrupted, according to state-by-state updates on Ascension's website.

Ascension operates 140 hospitals across 19 states and Washington, D.C.