Lurie Children's Hospital
A months-long cyberattack earlier this year on Lurie Children's Hospital that took down its phone lines, patient records and other services leaked the personal data of nearly 800,000 individuals.
According to a data breach notice filed yesterday with the Office of the Maine Attorney General, 791,784 people were affected by the cyberattack, which Lurie first identified in January.
Related: HHS, FBI issue phishing, ransomware attack advisory for providers
Lurie spokeswoman Julianne Bardele confirmed the number of people affected, adding that the Streeterville hospital “takes the security of our system and the information entrusted to us seriously.” Lurie is in the process of notifying individuals whose data was impacted by mail and other methods.
Leaked information includes names, addresses, drivers’ license numbers, health plan and claims information, medical conditions and diagnoses, Social Security numbers and other sensitive information, according to a notice posted to Lurie’s website yesterday.
Cybercriminals launched the attack on Jan. 26. By Jan. 31, Lurie had taken certain electronic systems offline, including phones, emails, patient portal MyChart and electronic health system Epic. Lurie, however, claims in its notice it has “no indication” cybercriminals accessed data stored in Epic.
Not a Modern Healthcare subscriber? Sign up today.
Some systems were down for months. It wasn’t until May that Lurie said it was no longer addressing an active security threat. All systems are now restored, Bardele said.
Lurie did not pay a ransom to end the attack, Bardele said, noting that experts warned the hospital making payments to cybercriminals does not guarantee the deletion or retrieval of data. Instead, Lurie worked with law enforcement, including the FBI, to retrieve data.
Even still, cybersecurity news outlet The Record previously reported ransomware group Rhysida sold data stolen from Lurie for $3.4 million.
Cyberattacks on hospitals and other healthcare providers are becoming more common as cybercriminals try to capitalize on the data-rich information housed by the healthcare sector. Aside from causing business-related headaches and costs, the attacks can also disrupt care and put lives in danger.
Download Modern Healthcare’s app to stay informed when industry news breaks.
“Lurie Children’s is not alone. Many organizations today, especially hospitals and health systems across the country, face constantly evolving cybersecurity threats,” Bardele wrote in an emailed statement. “For our part, we are working closely with our internal and external experts to further enhance the security of our systems.”
If patients have immediate needs, Lurie encourages them to contact the hospital at 888-401-0575.
This story first appeared in Crain's Chicago Business
Send us a letter
Have an opinion about this story? Click here to submit a Letter to the Editor, and we may publish it in print.
