Major U.S. health network Ascension hit by ransomware attack

MISSOURI, UNITED STATES — A major American health care provider has been crippled by a ransomware cyberattack, forcing it to divert ambulances from several hospitals. 

Ascension, a nonprofit network operating 140 hospitals across 19 U.S. states, confirmed on Thursday that it is dealing with a “ransomware incident” that has disrupted electronic health records, phone systems, and the ability to order tests and medications. 

The St. Louis-based company said it is using “downtime procedures” and reverting to paper records to continue caring for patients while its computer systems are down.

Russian-linked hackers suspected

Four sources briefed on the investigation told CNN the culprit is believed to be Black Basta ransomware, a strain of malicious code linked to Russian-speaking cybercriminals.

The Health Information Sharing and Analysis Center (H-ISAC) warned on Friday that Black Basta hackers have “recently accelerated attacks against the healthcare sector” in the U.S. and Europe, causing “severe operational disruptions” at multiple organizations.

Black Basta is considered a major threat due to its suspected ties to Russia and increasing focus on healthcare targets, according to an analysis by the U.S. Department of Health and Human Services (HHS).

“As ransomware attacks continue to increase, healthcare organizations should remain vigilant,” the HHS report stated.

Familiar playbook for cyber response

In response to the attack, Ascension has notified federal authorities, hired cybersecurity firm Mandiant, and taken systems offline to contain the incident—”a familiar playbook” used by many ransomware victims, CNN noted.

Senior U.S. officials have been in contact with Ascension’s CEO about potential impacts to patient care. The company said its “workforce is well trained” to use backup procedures safely. However, the operational disruptions highlight the vulnerability of America’s healthcare system to crippling cyberattacks. 

In February, a separate ransomware incident at UnitedHealth subsidiary Change Healthcare caused nationwide billing issues and data breaches impacting millions of Americans.