UMC Recovers EHR; Other Systems Offline 3 Weeks Post-Attack

Nearly three weeks after a ransomware attack disrupted its operations, UMC Health System has restored its electronic health records, but the Lubbock, Texas-based public health system is still working to recover other patient care IT systems.

See Also: Live Webinar | Endpoint Security: Defending Today’s Workforce Against Cyber Threats

Meanwhile, nearby Texas Tech University Health Sciences Center and its affiliated Texas Tech Physicians and Texas Tech Dental Oral Health Clinic also continue to deal with an IT outage apparently related to the UMC incident (see: Texas Hospital Diverting Ambulances In Wake of Attack).

In an update Friday, UMC said EHRs have been restored at all its locations, but it is still “working diligently” on bringing patient-facing systems back online, as well as internal programs for patient care, UMC still does not have an estimated timeline for full restoration of services.

“Patients can now access and communicate with UMCP Clinics through the MyTeamCare patient portal. We continue to make significant progress restoring services securely and safely across our network,” UMC said.

UMC’s emergency centers are accepting patients via ambulance, but are still diverting “a select number of patients,” the statement said.

“While these are important milestones in our recovery process, our investigation into the nature and scope of this incident remains ongoing, and we continue to work alongside third-party firms to safely restore full operations.”

UMC – also known as University Medical Center – operates a health and wellness hospital, pediatric hospital, multiple clinics and other facilities.

UMC did not immediately respond to Information Security Media Group’s request for additional details about the organization’s cyberattack and recovery, and whether the incident compromised patient or employee data.

UMC is also the primary teaching hospital for TTUHSC. While the two organizations have not publicly disclosed whether the ransomware attack on UMC spilled over onto TTUHSC systems, a notice for patients on TTUHSC’s website indicates the IT outages are related.

“The IT outage affects many of the shared systems that the TTUHSC and Texas Tech Physicians clinics and UMC use in daily operations. As a result, certain systems at TTUHSC are temporarily offline,” TTUHSC said.

TTUHSC in separate updates yesterday to students and to team members, said the organization is “working diligently” to restore services but does not currently have a timeframe as to when this will occur.

“TTUHSC and Texas Tech Physicians are currently experiencing an IT issue. Until further notice, team members, including our clinical staff and providers, will not be able to access TTUHSC electronic resources. However, clinics and pharmacies remain open,” TTUHSC said.

In the statement yesterday to students, TTUHSC Provost Darrin D’Agostino apologized about the impact that IT outage is having.

“I understand how frustrating and stressful this situation must be, especially as you navigate your coursework, clinical rotations and responsibilities, and other academic commitments,” D’Agostino said.

“We also want to remind you of the mental health and wellness resources available during this challenging period. If you feel overwhelmed, anxious, or need someone to talk to, our mental health services are ready to provide support,” he said.

TTUHSC did not immediately respond to ISMG’s request for comment and additional details about its outage.

Challenges Ahead

Some experts said that while UMC Health appears to be making progress on its restoration, damage from the ransomware incident is potentially widespread.

“The goal of ransomware operators is to infiltrate as much of the network as possible before delivering the encryption payload so they can cause as much disruption as possible in order to extract the largest ransom payment possible,” said Jon Miller, CEO and co-founder of anti-ransomware company, Halcyon.

“While UMC and TTUHSC are arguably separate entities, their networks may be highly integrated and even share some of the core network infrastructure,” he said.

“So, after the attackers get in there, compromise some user credentials to escalate privileges, and move laterally through the network, they very well could have compromised systems that TTUHSC uses as well as UMC.”

Given that UMC Health has restored its EHRs but not yet other critical systems, “it’s reasonable to assume that everything could have been compromised during the ransomware attack,” said Scott Weinberg, CEO, of IT services firm Neovera.

Depending on what measures were put in place to track and audit access, it’s going to be difficult to definitely understand what was touched, copied or modified,” he said.

Indeed, determining data compromise after a ransomware attack is often challenging for many organizations, said Greg Shanton, senior vice president of cybersecurity at Neovera.

“Without continuous monitoring and management of who is accessing or modifying systems, applications and, most importantly, data, organizations lack visibility,” he said.

Both structured data such as databases and unstructured data like files and emails need to be secured during transit and storage, he said. “The old security phrase ‘trust, but verify’ is more relevant than ever, and security controls must be regularly tested and verified to maintain vigilance.”