Michigan hospital system suffers cyberattack, again

For staff at McLaren Health Care, the experience is both familiar and frustrating.

The McLaren Health Care system in Michigan confirmed this week it has experienced a cyberattack, its second in less than a year.

The Michigan health system confirmed this week that it has experienced a cyberattack which has disrupted key systems. The health system also suffered a ransomware attack last fall.

McLaren hasn’t confirmed that the latest incident is a ransomware attack, only saying they have suffered a cyberattack.

Due to the limited access to key systems, McLaren said some non-emergency appointments, treatments and tests have been postponed and are being rescheduled. Ambulances were temporarily diverted from McLaren Port Huron Hospital, The Detroit Free-Press reported.

The system says it hasn’t determined if patient or employee data has been compromised.

“McLaren Health Care can now confirm the disruption to our information technology and phone systems that was reported yesterday was the result of a criminal cyber attack,” the system said in a post on its Facebook page. “Our information technology team continues to work with external cyber security experts to analyze the nature of the attack and mitigate the impacts of the threat actors.”

McLaren operates 13 hospitals in Michigan, along with a host of ambulatory surgery centers and clinics. McLaren also operates health plans covering more than 700,000 people in Michigan and Indiana.

The health system said in its post on Facebook Wednesday that several information technology systems continue to operate in downtime procedures.

“Currently, our facilities are largely operational and able to care for our communities and will continue to do so until operations are fully restored,” McLaren said on the post.

McLaren has advised patients to plan to show up for scheduled appointments. The system also suggested that patients should bring printed records of their prescriptions, allergies, physician orders for lab tests and the printed results of recent tests.

The system also said it regrets the disruptions to the public.“To the communities we are honored to serve, we deeply and sincerely apologize for any inconvenience the attack by these malicious threat actors has caused,” McLaren said.

The system said it is working with vendors to ensure that there are sufficient supplies and with insurers to ensure authorizations are processed for delivering care.

McLaren also thanked the staff for their work in the difficult situation.

“McLaren is incredibly grateful and humbled by the response of our team members and medical staff who have pulled together under these difficult circumstances to provide our communities with the care they need,” the system said on Facebook. “Our team members and medical staffs are displaying unbelievable, heartfelt compassion and camaraderie during this extended downtime.”

In October 2023, McLaren confirmed that it experienced an attack from a ransomware group. Information Security Media Group reported that a ransomware group known as BlackCat claimed to have stolen private information from 2.5 million McLaren patients.

Healthcare organizations continue to be the target of cyberattacks. More than 300 health data breaches were reported to the federal government in the first half of the year.

• Read more: The 10 largest health data breaches of the first half of 2024

OneBlood, a nonprofit blood center serving much of the southeastern United States, said last week that it suffered a ransomware attack. Some hospitals in the southeast saw delays in blood deliveries and impacts on patient care, according to the American Hospital Association. OneBlood said this week that it had restored critical systems.

The Ascension health system, which operates more than 100 hospitals and clinics, including some in Michigan, also experienced a cyberattack this spring that disrupted operations for weeks. Ascension said the attack affected patient care for weeks after the discovery of the breach, with some hospitals diverting ambulances and patients seeing longer waits at clinics. It took several weeks to restore electronic health records at some facilities.

Healthcare cyberattacks have received growing attention to their potential to harm patient safety, both to the hospitals that are attacked and on nearby facilities that absorb additional patients.

Cyberattacks on health systems are more expensive than any other sector, and that’s been the case for more than a decade, according to a report released last week by IBM. The average cyberattack in healthcare cost organizations $9.77 million, the report said.

Limor Kessem, the global lead for cyber crisis management at IBM, told Chief Healthcare Executive® that some cybercriminals in the past had shown reluctance to target hospitals, but that reticence is gone.

“At the end of the day, that's where they have a lot of leverage, and that's where they keep going,” Kessem said.

Most hospitals and medical groups were affected by the cyberattack of Change Healthcare, which handles business functions for many providers nationwide. Cybersecurity analysts have called it the most devastating attack in the healthcare sector.