Cyberattack forces health system to divert ambulances

TOPEKA, Kan. (AP) — A cyberattack on the Ascension health system operating in 19 states across the US forced some of its 140 hospitals to divert ambulances, caused patients to postpone medical tests and blocked online access to patient records.

An Ascension spokesperson said it detected “unusual activity” Wednesday on its computer network systems. Officials refused to say whether the non-profit Catholic health system, based in St. Louis, was the victim of a ransomware attack or whether it had paid a ransom, and it did not immediately respond to an email seeking updates.

But the attack had the hallmarks of a ransomware, and Ascension said it had called in Mandiant, the Google cybersecurity unit that is a leading responder to such attacks. Earlier this year, a cyberattack on Change Healthcare disrupted care systems nationwide, and the CEO of its parent, UnitedHealth Group Inc., acknowledged in testimony to Congress that it had paid a ransom of $22 million in bitcoin.

Ascension said that its electronic records system and the MyChart system that gives patients access to their records and allows them to communicate with their doctors were offline.

“We have determined this is a cybersecurity incident,” the national Ascension spokesperson’s statement said. “Our investigation and restoration work will take time to complete, and we do not have a timeline for completion.”

To prevent the automated spread of ransomware, hospital IT officials typically take electronic medical records and appointment-scheduling systems offline. UnitedHealth CEO Andrew Witty told congressional committees that Change Healthcare immediately disconnected from other systems to prevent the attack from spreading during its incident.

The Ascension spokesperson’s latest statement, issued Thursday, said ambulances had been diverted from “several” hospitals without naming them.

In Wichita, Kan., local news reports said the local emergency medical services started diverting all ambulance calls from its hospitals there Wednesday, though the health system’s spokesperson there said Friday that the full diversion of ambulances ended Thursday afternoon.