Heritage Valley Health System hit by hackers amid global ransom crisis

BEAVER — A Pennsylvania health system was taking steps late Tuesday to restore its computer network after being caught up in a worldwide cyberattack that patients reported forced the postponement of some surgeries.

Heritage Valley Health System said its two hospitals west of Pittsburgh, which have about 500 beds, and its satellite offices were struck by the same data scrambling software — apparentlys own in Ukraine — that also disrupted some government offices and major corporations worldwide.

Tuesday’s impact from the new strain of ransomware — malicious software that locks up computer files with all-but-unbreakable encryption and then demands a ransom for its release — spanned from the United States to India, although it hit hardest in Ukraine and Russia.

It marked the second consecutive month that such an epidemic swept the world.

Spokeswoman Suzanne Sakson said the $480 million Heritage Valley system — which provides care for residents of Allegheny, Beaver, Butler and Lawrence counties; parts of eastern Ohio; and the panhandle of West Virginia — had to make “operational adjustments” to ensure patient safety but declined to provide further details.

Patients were posting on social media that some surgeries were rescheduled as a result of the computer woes.

A woman who was at Heritage Valley Beaver to get her gallbladder removed said she knew there was a problem when she heard a voice come over a loudspeaker that directed staffers to come to a command center.

Brenda Pisarsky, 56, a shipping office worker from Wellsville, Ohio, told The Associated Press she noticed that computer monitors were off and saw nurses scurrying around with stacks of paperwork.

Ms. Pisarsky said she had already been prepped for surgery so doctors went through with her procedure, but that she was told some other patients had to have their operations rescheduled.

Also affected is New Jersey-based Merck, the second-largest drugmaker in the U.S. with extensive operations in the Philadelphia area. All U.S. offices of Merck were affected, said one scientist who works at a Merck lab in New England.

The data-scrambling software’s pace appeared to slow as the day wore on, in part because the malware appeared to require direct contact between computer networks, a factor that may have limited its spread in regions with fewer connections to Ukraine.

The malware’s origins remain unclear. Researchers picking the program apart found evidence its creators had borrowed from leaked National Security Agency code, raising the possibility that the digital havoc had spread using U.S. taxpayerfunded tools.