UMMC has closed statewide clinics and cancelled non-urgent appointments after a cyberattack disrupted its electronic medical records and IT systems.
The University of Mississippi Medical Center (UMMC) has confirmed that due to a cyberattack its computer systems are down, leading it to close all statewide clinics and cancel non-urgent medical appointments and procedures through at least the following day.
The hospital was continuing to provide emergency and time-sensitive services using manual ‘downtime’ protocols that can function without electronic medical records, like paper charts. Dialysis services at one location remained operational.
The attack impacted access to the hospital system’s electronic medical records platform, Epic, along with other IT systems that support scheduling, billing, test results and chart documentation.
At press briefings, UMMC leadership said they did not yet know the extent of any compromise to patients’ personal data.
UMMC is one of Mississippi’s largest health systems, operating seven hospitals and 35 clinics across the state. It has not publicly confirmed the specific nature of the attack.
Industry experts from Suzu Labs and Xcape have responded to the news.
Steven Swift, Managing Director, Suzu Labs, said: “Typically, when a ransomware campaign successfully detonates across a large organisation, it takes down a large amount of systems in a co-ordinated attack. The aim is for maximum disruption, so that in this case UMMC is motivated enough to pay the ransom.
“The standard response for such an attack is for incident response personnel to implement emergency containment of the network, to stop any further spread. And to ensure that any and all remote access that attackers may have gets cut off.
“This means from the outside, there’s not a great way to tell if systems are down because they were directly impacted by ransomware, or if they’re down because the team implemented containment mechanisms specifically to protect these systems. Especially early on in a major attack like this.
“In ransomware response, it is normally recommended that organisations avoid paying a ransom if at all possible. Healthcare organisations like UMMC are put in a tough spot, as even if they have the capability to fully restore from backups, it typically takes longer to recover from a major ransomware like this than it does to pay a ransom and get the systems back on. It can be hard to justify that time gap, considering the patient impact that this attack is having.
“Backup systems are a primary target for all ransomware groups these days, it certainly isn’t guaranteed that it even is possible to recover. Most high impact ransomware attacks linger in network long enough to fully compromise backups and identify other relevant key targets before actually encrypting everything and demanding a ransom.
“It’s critical that organisations plan their backup systems with this in mind. Build resiliency into backup architecture. Keep a copy of backups offline and/or in immutable storage.
“Similarly, organisations should be designing their security architecture around high impact threats such as ransomware. Ensure that EDR is on all systems. Perform annual pentests that mimic the techniques used in ransomware, so you can find and fix critical security gaps before a bad actor finds it. Upgrade legacy MFA solutions to be phishing resistant, so that it’s difficult for attackers to get that initial foothold. Perform credential audits, so you can find/fix all the poor quality and repeated passwords being used. Perform vulnerability scans and actually patch and keep systems current.
“Most of all, ensure that the organisation has someone with appropriate experience in charge of running the security program. And that they’re given adequate resources for staff and technical tooling.”
Damon Small, Board of Directors, Xcape, said: “The complete system outage at the University of Mississippi Medical Center (UMMC) starkly illustrates how a loss of the electronic health record (EHR) can impede the quality of patient care. By blocking access to the Epic platform, cyberattackers have effectively incapacitated caregivers and forced them to return to manual ‘paper-and-pen’ methods.
“Healthcare organisations must recognise that they are attractive targets and should proactively invest in network segmentation, data backups and incident response capabilities.”
