Vermont’s largest hospital has been working for more than two weeks to break free from a cyberattack that has debilitated many of the health center’s functions just as the state is seeing its coronavirus hospitalization and case numbers spike.
The attack on the University of Vermont Medical Center in Burlington began on Oct. 28, and locked staff out of many of the systems they use every day to provide care. For a while, the hospital was not even able to provide chemotherapy treatments, and even now its ability to do so is limited.
The hospital’s emergency room, urgent care center and maternity ward remain open, but officials are trying to divert more patients to clinics and other hospitals.
“What I can tell you is that this attack was very broad in its reach,” Dr. John Brumsted, the president of the U.V.M. Health Network, said in a statement this week. Hospital officials have declined to divulge many details about the attack or any suspected perpetrators, citing a federal investigation. Several other hospitals have been hit with cyberattacks in recent weeks, and federal authorities and experts have warned about a possible wave of attacks against U.S. hospitals.
With few cases, Vermont had been something of a model during the pandemic, but it reported its most positive tests to date on Wednesday. More people in the state were hospitalized with Covid-19 than at any point since August, according to the Covid Tracking Project.
A breakthrough in the cyberattack came on Thursday when technology experts — including members of the Vermont National Guard — were finally able to get doctors and nurses access to patients’ medical histories that had been blocked, a spokesman said. Even so, they still cannot update or edit them.
Hospitals all over the country have been targeted in a scourge of ransomware attacks in recent months. In September, an attack on Universal Health Services, which runs more than 400 hospitals throughout the country, became the largest medical cyberattack in history.
The attacks have surged in recent weeks. Russian cybercriminals had made a concerted effort to target hospitals, in retaliation, some cybersecurity experts believe, for separate operations by the Pentagon’s United States Cyber Command and Microsoft against Russian hackers in the weeks ahead of the election.
On private message boards, cybercriminals shared a list of more than 400 American hospitals they said they aimed to attack. The list was captured in a private exchange by Hold Security, a Milwaukee-based security firm, and shared with law enforcement last month.
Earlier this year, a woman in Germany was turned away at a hospital in Düsseldorf that was being held hostage in a ransomware attack. She was sent to a hospital 20 miles away and died from treatment delays.
— Nicholas Bogel-Burroughs and Nicole Perlroth The New York Times