When we think of the dangers of cyberattacks, physical harm is not often the first thing that comes to mind. But when a cyberattack involves a hospital or healthcare provider, things can change pretty quickly.
Tallahassee Memorial Healthcare (TMH), a private, not-for-profit healthcare system based in North Florida and South Georgia, recently detected a cyberattack on its IT systems, which prompted the organization to take systems offline in a bid to limit the impact of the attack.
TMH issued a statement on Friday, confirming the cyberattack and assuring everyone that patient safety remains its top priority. It is in the process of reviewing each of its IT systems, prioritizing them, and bringing them back online one by one. The healthcare system added that it would be contacting patients who had appointments affected by the security breach, apologizing for any inconvenience or delays that the breach may have caused.
As every organization should do when experiencing a cyber incident, TMH reported to law enforcement and is now working with them as part of an ongoing investigation. The incident is suspected to be the result of a ransomware attack, according to local media reports, which cited sources with knowledge of the situation.
As a result of the cyberattack, non-emergency surgical and outpatient procedures scheduled for Monday, February 6, were canceled and rescheduled. The healthcare system also informed patients that they would be accepting Level 1 traumas only from its immediate service area and that other patients requiring emergency medical services (EMS) would be diverted to other hospitals.
Despite the inconvenience, TMH reassured its patients that it had implemented backup and downtime protocols, including relying on paper documentation, to enable its staff to continue to provide safe and high-quality care to patients.
TMH also stated that it would provide updates as the investigation progresses, bearing in mind that security, privacy, and law enforcement considerations impact the amount of detail it can provide.
The Tallahassee Memorial Healthcare incident is the second suspected ransomware attack involving U.S. hospitals in 2023 and follows the 25 attacks against health systems operating 290 hospitals that took place last year, according to Emsisoft threat analyst Brett Callow, who spoke with BleepingComputer about the incident.
Since the beginning of the pandemic, the U.S. federal government has been warning healthcare organizations across the country about the increasing threat of ransomware operations known for actively targeting the sector, such as the Royal, Venus, Maui, and Zeppelin ransomware operations.
It is vital for healthcare organizations to take the necessary steps to secure their IT systems, especially as the sector continues to be an attractive target for cybercriminals.
