Cyberattack prompted network outage at Lurie Children's Hospital, facility says

CHICAGO (CBS) -- A major and ongoing network outage that disrupted phone and internet service at Lurie Children's Hospital was brought about by a cyberattack, the hospital announced Thursday night.

"Lurie Children's is actively responding to a cybersecurity matter," the hospital posted. "We are taking this very seriously, are investigating with the support of leading experts, and are working in collaboration with law enforcement agencies. As part of our response to this matter, we have taken network systems offline."

The network outage impacted phone and internet service at the hospital in the Streeterville neighborhood, and was not over as of Friday night. 

The outage impacted Lurie's entire network – not just the hospital in Streeterville. Patients at Hinsdale Pediatrics told patients to bring hard copies of their ID and insurance – as their electronic systems were down.

The phone lines also went down at a primary care center at 1450 N. Halsted St., a primary care center in Glenview, an outpatient center in Skokie – and 55 offices across the Chicago area.

An internal memo obtained by CBS 2 revealed Lurie began experiencing service disruptions early on Wednesday.

"As Illinois' leading provider for pediatric care, our overarching priority is to continue providing safe, quality care to our patients and the communities we serve. Lurie Children's is open and providing care to patients with as few disruptions as possible," the hospital posted Thursday night.

Lurie Children's announced Friday evening that it has established a dedicated call center to address the needs of patient families and community providers. The number is 1-800-543-7362.

The call center is open from 8 a.m. to 8 p.m. Monday through Friday, 8 a.m. to 5 p.m. Saturday, and 8 a.m. to noon Sunday.

Anyone may call with non-urgent patient requests and care questions, information on scheduled patient appointments, or  prescription refill requests. Due to high volumes, callers may get a busy signal. The hospital says anyone who does should call back.

Cybersecurity experts said they are not surprised the outage has lasted this long. Meanwhile, parents said they want more communication.

"Of course, we're concerned about data and privacy, and making sure that my daughter's healthcare information is protected and secure," said Jennifer Sabourin.

Sabourin traveled into the city from the western suburbs Wednesday morning with her 9-year-old daughter, Ellie, to undergo a procedure that had taken months to schedule.

Sabourin said they checked in three different times before they were suddenly told the procedure was canceled due to a network outage.

"I immediately suspected that there was some sort of hacking or cybersecurity attack," said Sambourin.

Since then, Sabourin hasn't heard a peep from Lurie about what's happening, and said she — like many parents — is frustrated and concerned about when they will be able to reschedule such an important procedure.

"I haven't received any communication, and there's still no way to get a hold of anyone for information," said Sabourin.

Sabourin and her daughter have been left in limbo.

"We are just waiting to hear next steps," she said. "I'm at their mercy at this point."

Ashlie Andersen's daughter was supposed to see a doctor for a test procedure at Lurie on Friday. But like so many other patients, she was unable to access online records – or get a hold of the hospital to confirm whether her appointment was canceled – due to the ongoing cyberattack.

"I just wasn't clear if we were supposed to still go, or not go," Andersen said, "and it's something, you know, we wanted to get looked and taken care of sooner than later with my daughter."

While the specifics of this particular cybersecurity threat were not known late Friday, Cybersecurity expert Dr. Vahid Behzadan says attacks against health care institutions are unfortunately becoming more common.

"If I were to guess, I would say it may be a ransomware attack," said Behzadan, an assistant professor of data science at the University of New Haven.

Robin Berthier, chief executive officer of the Chicago-based cybersecurity firm Network Perception, also said the cybersecurity incident at Lurie has all the signs of a ransomware attack.

"Those are targets of opportunities. They are done for financial gain," said Berthier. "We've seen a rise of the volume and sophistication of those attacks."

Just this week, the FBI warned of the growing threat of foreign cyberattacks against U.S. electrical grids and other vital infrastructure.

"The risk that poses to every American requires our attention now," said FBI Director Christopher Wray.

Behzadan said a hospital's cyber ecosystem is very complex, and could have many vulnerable spots.

"A system that was vulnerable; that was not so very well protected, or it may have been through phishing and social engineering," he said. "Maybe a particular user; a particular employee was compromised - and then that compromise escalated into a full-on network breach."

Behzadan said security teams are having to do two things at once - determine the extent of the breach and try to replace the system at the same time.

"I've seen cases where a recovery to full-on operation has taken months," said Behzadan, "but I'm hopeful that in the case of this hospital, it's maybe in the order of days until at least some semblance of regular operation comes back."

Meanwhile, patient files were copied in an unrelated cyberattack at St. Anthony Hospital on Chicago's West Side in December.

Concerns about a data breach is shared by families impacted by the latest cyber incident at Lurie Children's Hospital.

"Hopefully, our information doesn't get leaked out all over the place," said Andersen.