Ransomware attack delays patient care at hospitals across the U.S.

One of the largest hospital chains in the U.S. was hit with a suspected ransomware cyberattack this week, leading to delayed surgeries, hold ups in patient care and rescheduled doctor appointments across the country.

CommonSpirit Health, ranked as the fourth-largest health system in the country by Becker’s Hospital Review, said Tuesday that it had experienced “an IT security issue” that forced it to take certain systems offline.

While CommonSpirit declined to share specifics, a person familiar with its remediation efforts confirmed to NBC News that it had sustained a ransomware attack.

CommonSpirit, which has more than 140 hospitals in the U.S., also declined to share information on how many of its facilities were experiencing delays. Multiple hospitals, however, including CHI Memorial Hospital in Tennessee, some St. Luke’s hospitals in Texas, and Virginia Mason Franciscan Health in Seattle all have announced they were affected.

One Texas woman, who spoke to NBC News on the condition of anonymity to protect her family’s medical privacy, said that she and her husband had arrived at a CommonSpirit-affiliated hospital on Wednesday for long-scheduled major surgery, only for his doctor to recommend delaying it until the hospital’s technical issues were resolved.

The surgeon “told me it could potentially delay post-op care, and he didn’t want to risk it,” she said. 

• Add to Google

Officials sound nationwide alarm over cyber attacks against schools

02:41

Ransomware attacks on health care chains are relatively common, and have been a frequent part of the U.S. medical system for more than two years. Even if an attack doesn’t shut a hospital down, it can knock some or all digital systems offline, cutting doctors’ and nurses’ access to digital information like patient records and recommendations for care.

For Subscribers

FOR SUBSCRIBERSAbdul El-Sayed tries to woo MAHA voters as Democrats seek inroads with RFK’s supporters

FOR SUBSCRIBERSGOP super PAC increases its spending for Sen. Jon Husted in tough Ohio race

FOR SUBSCRIBERSKratom-like substances are popping up in a typically benign supplement

FOR SUBSCRIBERSRecords reveal tumultuous marriage between killed New York Times executive and wife

FOR SUBSCRIBERSFrom clean energy warrior to ‘wall of shame,’ James Talarico reverses on a fossil fuel money pledge

FOR SUBSCRIBERSCongressional staff planned official trip with luxury stops in Italy and France weeks before election

FOR SUBSCRIBERSA harrowing ordeal aboard an Israel-bound plane

FOR SUBSCRIBERSOpenAI CEO Sam Altman to skip congressional hearing on rogue AI agents

FOR SUBSCRIBERSKey DOJ lawyers departed Trump ‘grand conspiracy’ probe amid pressure to produce, source says

FOR SUBSCRIBERSTrump’s new AI chatbot often links to a site launched under Clinton 26 years ago

FOR SUBSCRIBERSAt MAHA summit, industry CEOs the movement once vilified take the stage

FOR SUBSCRIBERSThis Paralympian has two goals: Win medals and give away $500,000 to her teammates

FOR SUBSCRIBERSCornell rape allegation spotlights stringent New York state laws that have long drawn criticism

FOR SUBSCRIBERSThe debate over AI’s future rages on both coasts

FOR SUBSCRIBERSDecades-old march dispute reignites in Northern Ireland, threatening political crisis

Brett Callow, an analyst at Emsisoft, a cybersecurity company that specializes in ransomware, said that he was aware of at least 15 health care companies representing 61 hospitals that have been hit by ransomware attacks so far this year.

For Subscribers

FOR SUBSCRIBERSAbdul El-Sayed tries to woo MAHA voters as Democrats seek inroads with RFK’s supporters

FOR SUBSCRIBERSGOP super PAC increases its spending for Sen. Jon Husted in tough Ohio race

FOR SUBSCRIBERSKratom-like substances are popping up in a typically benign supplement

FOR SUBSCRIBERSRecords reveal tumultuous marriage between killed New York Times executive and wife

FOR SUBSCRIBERSFrom clean energy warrior to ‘wall of shame,’ James Talarico reverses on a fossil fuel money pledge

FOR SUBSCRIBERSCongressional staff planned official trip with luxury stops in Italy and France weeks before election

FOR SUBSCRIBERSA harrowing ordeal aboard an Israel-bound plane

FOR SUBSCRIBERSOpenAI CEO Sam Altman to skip congressional hearing on rogue AI agents

FOR SUBSCRIBERSKey DOJ lawyers departed Trump ‘grand conspiracy’ probe amid pressure to produce, source says

FOR SUBSCRIBERSTrump’s new AI chatbot often links to a site launched under Clinton 26 years ago

FOR SUBSCRIBERSAt MAHA summit, industry CEOs the movement once vilified take the stage

FOR SUBSCRIBERSThis Paralympian has two goals: Win medals and give away $500,000 to her teammates

FOR SUBSCRIBERSCornell rape allegation spotlights stringent New York state laws that have long drawn criticism

FOR SUBSCRIBERSThe debate over AI’s future rages on both coasts

FOR SUBSCRIBERSDecades-old march dispute reignites in Northern Ireland, threatening political crisis

To date, there is only one documented instance in which an American has publicly claimed that ransomware directly led to a patient’s death. An Alabama woman sued her hospital in 2020 after her baby was born with a severe brain injury and died after her hospital was hit by a ransomware attack and allegedly didn’t inform her.

However, a major report by the federal Cybersecurity and Infrastructure Security Agency and a survey of health care information technology professionals found that a ransomware attack on a hospital increases the stress on its capabilities in general, and leads to higher mortality rates there.