Chicago’s biggest children’s hospital, Ann & Robert H. Lurie Children’s, has entered its second week of reduced service as it tries to recover from a cyberattack.
Most of the hospital’s internet-connected equipment, including phones, email access and electronic health records, have been offline since the start of the incident, the hospital has said, making it significantly more difficult for parents to stay in touch with their doctors. Many appointments and surgeries are still being honored, the hospital said Monday.
“There is a special place in hell for a person who attacks a children’s hospital and disrupts medical care for thousands of innocent children,” said Deborah Land, whose teenage daughter is a patient at the hospital.
On its website, the hospital said, “Lurie Children’s is actively responding to a cybersecurity matter. We are taking this very seriously, are investigating with the support of leading experts, and are working in collaboration with law enforcement agencies. As part of our response to this matter, we have proactively taken network systems offline which is currently impacting our phone, email and electronic systems.”
A spokesperson for the hospital told NBC News by text message that Lurie Children’s took its systems offline Jan. 31, meaning that it has been operating at significantly reduced capability for more than a week.
In a press release put out Thursday afternoon, the hospital confirmed that its network was accessed by "a known criminal threat actor."
Experts say the incident is consistent with a ransomware attack. Ransomware hackers, often located in Russia, where they’re safe from extradition to other countries, frequently take over hospital networks and demand payment in cryptocurrency.
“From the outside, this has all the hallmarks of a hospital ransomware attack: patients being rerouted to other hospitals, phone and computer systems offline and staff being forced to retrieve medical records by hand,” said Alan Liska, an analyst at the cybersecurity company Recorded Future.
“If so, it’s part of an unfortunate trend of health care providers being increasingly targeted by ransomware groups. In 2024 alone, there have already been 24 publicly reported ransomware attacks against healthcare providers,” he said.
Land said that the outage has caused an infuriating runaround. Her daughter needs bloodwork completed for an appointment next week. But the digital order to get that bloodwork is inaccessible because Lurie’s systems are down, and despite repeated calls to the hospital’s emergency call center and a visit to the hospital, no one has given her a paper order for the bloodwork.
Her daughter is on a controlled substance and needs to refill her prescription every week, she said. Because Lurie patients currently don’t have access to MyChart, a popular medical program that lets patients message with doctors and doctors to write prescriptions, Land had to scramble to find another doctor to renew her daughter’s prescription.
“I still have not been able to reach the specialist. There’s no phone number at the hospital I can call. I cannot email. I cannot MyChart,” Lurie said. She said that one hospital staffer called her from a private number to tell her that a virtual appointment had been canceled, but that meant there was no way to call back and reschedule.
“It’s a total mess. The hospital’s not telling anybody anything,” she said.
The hospital spokesperson did not respond to questions about Land’s experiences.
Other individuals took to Facebook to describe their own struggles in the comments on posts. “what do you do when you’ve called the call center 3 times (3 days in a row) and still haven’t received a call back?” one commenter wrote. “We’ve been waiting on test results for a week. I never received a call back. I have no idea how to help him.”
It’s unclear when Lurie Childrens will resume full functionality.
“We recognize the frustration of not having clarity on when this will be resolved. Our investigation remains ongoing and we are working around the clock to resolve this matter,” the hospital announced on its website Monday evening, its most recent update.
Despite several Western government initiatives against ransomware, the problem has continued to worsen. Last year saw more ransomware attacks on U.S. health care networks than ever before, according to the cybersecurity company Emsisoft. A report published Wednesday found that victims had paid a record $1 billion in 2023, enshrining it as an especially lucrative type of cybercrime.
Last year, an Illinois hospital closed in part because of the financial strain of dealing with a ransomware attack