CHICAGO (AP) 鈥� Details of an apparent cyberattack on one of the largest health systems in the U.S. were slow to emerge as security experts on Friday warned that it often takes time to assess the full impact on patients and hospitals.
Earlier this week, CommonSpirit Health confirmed it experienced an 鈥淚T security issue鈥� but it has yet to answer detailed questions about the incident, including how many of its 1,000 care sites that serve 20 million Americans may have been affected. The health system giant, which is the second largest nonprofit health system in America, has 140 hospitals in 21 states.
鈥淚t actually takes a while to fully know the scope because you鈥檙e in the middle of trying to restore all your systems,鈥� said Allan Liska, an analyst with the cybersecurity firm Recorded Future. 鈥淵ou鈥檙e trying to get patient care up and running. You鈥檙e trying to get your nurses and your doctors back to the systems they need.鈥�
Healthcare organizations are an appealing target for cyber attackers 鈥� particularly those who use malware to lock up a victim organization's files and leverage the information for a payment. Ransomware has remained a persistent threat for the industry, which is among the 16 sectors the U.S. government classifies as critical infrastructure.
鈥淩ansomware actors know that鈥檚 going to cause a lot of disruption,鈥� Liska said.
Health care systems in 2021 saw an unusually high amount of attacks, with 285 publicly reported worldwide, Liska added. So far, Liska's firm has tracked 155 this year with an average of 20 attacks happening a month. However, he estimated that only about 10% of ransomware attacks are publicized.
Cybersecurity experts said years of work have built health care leaders' trust in the FBI and other federal agencies focused on cyber crime.
An FBI spokesperson did not immediately respond to questions on whether they were investigating the CommonSpirit Health cyberattack.
John Riggi, the American Hospital Association's national advisor for cybersecurity and risk, said he could not discuss CommonSpirit specifically. In general, though, he said it can take days, weeks or more to discover how an attacker gained access, determine what damage has been done and prevent further harm.
Riggi, who spent nearly 30 years with the FBI, called any significant cyber attack on a hospital 鈥渁 potential risk to patient safety" and said the U.S. government takes that seriously. Their goal, he said, is to identify the attacker and make their identity and methodology public.
鈥淭hey don't want to show their hand, what they know about the bad guys,鈥� he said. 鈥淵ou're really processing a crime scene in real time.鈥�
But there are risks to victims of cyber attacks who fail to communicate their response plan and strategies for recovery, said Mike Hamilton, the chief information security officer with Critical Insights Cybersecurity in Washington state.
The reaction of patients, staff and affiliated health care operations to the chain's handling of the incident all could affect the company's future survival, he said.
"Here鈥檚 how close we are to resolution, here鈥檚 where we鈥檙e diverting, here are the other hospitals we鈥檙e partnering with," Hamilton said. 鈥淭hey need to be sure they鈥檙e communicating ... because so many people are being impacted by this.鈥�
___
Kruesi reported from Nashville, Tenn.
Kathleen Foody And Kimberlee Kruesi (), The Associated Press
