A significant healthcare supplier whose methods have been knocked offline for 3 weeks by a ransomware assault has been requested by a US senator to reply questions on its cybersecurity practices.
UHS initially reported the assault as an “Data Know-how safety incident,” however employees who took screenshots of the assault confirmed that ransomware was chargeable for the disruption.
On account of the incident, UHS disconnected all methods and shut down the community to forestall additional propagation. Whereas some hospitals diverted ambulances and a few lab check outcomes have been delayed, the corporate said that “affected person care was delivered safely and successfully at our amenities throughout the nation utilizing established back-up processes, together with offline documentation strategies.”
Following the assault, former know-how entrepreneur and vice chairman of the Senate Intelligence Committee, Senator Mark Warner, has written to UHS to precise issues concerning their cybersecurity measures.
Warner advised the Fortune 500 firm that with annual income of greater than $11bn, it ought to have a cybersecurity posture “sufficiently mature and sturdy to forestall main interruptions to well being care operations.”
In his letter dated October 9, the senator questioned UHS over its vulnerability administration course of, third-party danger administration, safety of medical medical units, and skill to isolate networks to forestall lateral motion by attackers.
Warner additionally requested UHS to state whether or not it had paid a ransom to its attackers and to substantiate whether or not any affected person medical data, HIPAA-protected knowledge, or healthcare data has been affected or suffered a denial of entry on account of the assault.
On October 12, UHS stated: “All through the IT remediation work we have now had no indication that any affected person or worker knowledge was accessed, copied or misused.”
UHS, which is headquartered in King of Prussia, Pennsylvania, operates amenities in Puerto Rico, the UK, and the US. In a statement launched on September 29, the corporate mentioned that its UK operations weren’t impacted by the assault.