Ascension healthcare system says hackers stole hospital patient information in cyberattack last month
CHICAGO — Cybercriminals stole data about patients in a ransomware attack that forced Ascension to revert to using paperwork last month, the hospital system said.
The video in the player above is from a previous report.
Data was stolen from seven of its nearly 25,000 servers across the country, Ascension said in a statement posted Wednesday. Some stolen files contained health data and personally identifiable information.
ABC7 Chicago is now streaming 24/7. Click here to watch
Ascension said there is no evidence that data was stolen from its electronic health records, which contain full patient records.
The attacker infiltrated the hospital network after an employee accidentally downloaded a malicious file, according to Ascension.
The hospital system said it doesn’t know exactly which patients were affected in the May 8 attack. As a precaution, Ascension is offering all patients free credit monitoring and identity theft protection services through its call center at 1-888-498-8066.
READ MORE | Ascension health experiences cybersecurity problem, detects ‘unusual activity’ in network systems
Earlier this week, Ascension said it restored electronic record systems to its Illinois hospitals. The hospital group operates 150 sites of care and more than a dozen hospitals in Illinois, including Ascension Resurrection in Chicago, St. Alexius in Hoffman Estates and Alexian Brothers in Elk Grove Village.
Cybercriminals are targeting hospital systems more often, with attacks nearly doubling between 2018 and 2022, according to the U.S. Department of Health and Human Services. The Biden administration last month announced plans to require cybersecurity standards for hospitals after a hack of Change Healthcare, part of UnitedHealth Group Inc., exposed the data of 100 million Americans.
At least two other hospital systems in the Chicago area have been attacked this year. The University of Chicago Medical Center said it was victim of a hack that may have exposed patient data in late May. A January hack of Lurie Children’s Hospital took down its phone, email and computer system for six weeks.
The Sun-Times reported Monday that federal authorities have opened a criminal investigation into a hack of the Cook County hospital system that potentially affected 1.2 million patients. One class-action lawsuit notes that the county health system learned of the problem in July 2023 but did not notify patients for three months.
