Patients of a Vermont Hospital Are Left âin the Darkâ After a Cyberattack
The F.B.I. estimated that the cybercriminals, who use ransomware called âRyuk,â took in more than $61 million in ransom over a period of 21 months in 2018 and 2019, a record. What would you do if you were a hospital administrator and hackers attacked your computer systems which made it unable to serve only about one in four of your normal chemotherapy patients: (1) pay a multi-million ransom, or (2) refuse to pay? Why? What are the ethics underlying your decision? Â
At lunchtime on Oct. 28, Colleen Cargill was in the cancer center at the University of Vermont Medical Center, preparing patients for their chemotherapy infusions. A new patient will sometimes be teary and frightened, but the nurses try to make it welcoming, offering trail mix and a warm blanket, a seat with a view of a garden.
Then they work with extreme precision: checking platelet and white blood cell counts, measuring each dosage to a milligram per square foot of body area, before settling the person into a port and hooking them up to an IV.
That day, though, Ms. Cargill did a double-take: When she tried to log in to her work station, it booted her out. Then it happened again. She turned to the system of pneumatic tubes used to transport lab work. What she saw there was a red caution symbol, a circle with a cross. She walked to the backup computer. It was down, too.
âI wasnât panicky,â she said, âand then I noticed my cordless phone didnât work.â That was, she said, the beginning of the worst 10 days of her career.
Cyberattacks on Americaâs health systems have become their own kind of pandemic over the past year as Russian cybercriminals have shut down clinical trials and treatment studies for the coronavirus vaccine and cut off hospitalsâ access to patient records, demanding multimillion-dollar ransoms for their return.
Complicating the response, President Trump last week fired Christopher Krebs, the director of CISA, the cybersecurity agency responsible for defending critical systems, including hospitals and elections, against cyberattacks, after Mr. Krebs disputed Mr. Trumpâs baseless claims of voter fraud.
The attacks have largely unfolded in private, as hospitals scramble to restore their systems â or to quietly pay the ransom â without releasing information that could compromise an F.B.I. investigation.
But they have had a devastating and long-lasting effect, particularly on cancer patients, said workers and patients from Vermontâs largest medical system. Its electronic medical record system was restored on Sunday, nearly a month after the cyberattack.
In the interim, clinicians were forced to send away hundreds of cancer patients, said Olivia Thompson, a nurse at the cancer center.
The staff fell back on written notes and faxes, leafing through masses of paper to access vital information. They tried to reconstruct complex chemotherapy protocols from memory.
And while the hospital has taken pains to reassure patients that most care could proceed, some staff members worry that the full damage of the October attack is not well understood.
âTo recover from something like this is going to take months and months and months,â Ms. Thompson said. âIt feels like we are all alone and no one understands how dire this is.â
Elise Legere, a nurse at the cancer center, said she could compare the past weeks to only one experience â working in a burn unit after the Boston Marathon bombing â and has often found herself wondering about the motivation behind the cyberattack.
âItâs like asking whatâs the point of putting a bomb in an elementary school, what is the point?â she said. âThere is a lot of evil in the world. Whoever did orchestrate this attack knows a lot about how devastating it is.â
The latest wave of attacks, which hit about a dozen hospitals in the United States, was believed to have been conducted by a particularly powerful group of Russian-speaking hackers that deployed ransomware via TrickBot, a vast network of infected computers used for cyberattacks, according to security researchers who are tracking the attacks.
The hackers typically work for profit. The F.B.I. estimated that the cybercriminals, who use ransomware called âRyuk,â took in more than $61 million in ransom over a period of 21 months in 2018 and 2019, a record.
The attacks slowed last spring, when cybercriminals agreed among themselves to avoid hacking hospitals amid the pandemic, security researchers said. But just ahead of the presidential election, the groups resumed.
âIn the past, they targeted organizations all over the world, but this time they were very specifically aiming for hospitals in the United States,â said Alex Holden, the chief executive of Hold Security, a Milwaukee firm.
The F.B.I. says it will not comment on the attacks, citing ongoing investigations.
Mr. Holden and other cybersecurity experts say that the targets and the timing â just weeks after the United States targeted TrickBot â suggest that one possible motivation could be retaliation.
In late September and October, fearing that cybercriminals could use ransomware to disrupt the election, the Pentagonâs Cyber Command started hacking TrickBotâs systems. Microsoft pursued the systems in federal court, successfully dismantling 94 percent of TrickBotâs servers.
The takedowns relegated TrickBotâs operators to âa wounded animal lashing out,â Mr. Holden said. His firm captured online messages sent among the group, including a list of 400 American hospitals they planned to target, and informed law enforcement.
âWe expect panic,â one hacker wrote, in Russian.
U.S. officials warned hospitals about a âcredible threatâ of attacks on Oct. 23, and then an unusual cluster of attacks on hospitals took place. Several hospital networks â including The University of Vermont Health Network and the St. Lawrence County health system in New York â have said they received no ransom note.
Others reported ransom demands âin eight figures, which is just not something that regional health care systems can do,â said Allan Liska, an analyst with Recorded Future, a cybersecurity firm. These unusual demands, combined with the coordination of the attacks, make âit seem that it was meant to be a disruptive attackâ rather than a profit-seeking one, he said.
Mr. Holden said many of the health systems opted to negotiate with their extortionists, even as ransoms jump into the millions.
âA great number of victims are dealing with these attacks on their own,â he said.
In Vermont, the damage radiated out through a sprawling network, hitting especially hard in the cancer center.
âMy really good friends are I.C.U. nurses, and theyâre like, no big deal, all we have to do is paper charting,â Ms. Cargill, the charge nurse, said. But the cancer center was badly set back for weeks, able to serve only about one in four of its normal chemotherapy patients.
Ms. Cargill spent the rest of the day turning away patients, an experience she cannot relate without beginning to cry, nearly a month later.
âTo look someone in the eye, and tell them they cannot have their life-extending or lifesaving treatment, it was horrible, and totally heart-wrenching,â she said. The very first person she turned away, a young woman, burst into tears.
âShe said, âI have to get chemo, I am the mother of two young kids,ââ Ms. Cargill said. âShe was so fearful, and the fear was tangible.â
In the days that followed, clinicians attempted to prioritize patients and recreate chemotherapy protocols from memory, gradually aided by backup chart information, said Ms. Legere, a nurse navigator in the unit.
âThey were trying to remember everything they knew about a patient, but none of that is accurate,â she said. âOur brains are not designed to be electronic medical records. Thatâs not safe, and we all know it.â
Patients, she said, âfeel very in the dark about when they will get treated,â and many cancer patients who live in rural areas do not have the resources to drive four hours to Boston for treatment.
âVermont feels intentional, it feels scouted in the sense that it would cause a ton of panic,â she said. âThe federal and statewide response is where Iâm feeling very deserted. Maybe thereâs stuff I donât see.â
Lawmakers have also accused the Trump administration of marring the federal response.
In an email to The New York Times, Senator Gary Peters, a Democrat of Michigan and member of the Homeland Security Committee, called the presidentâs firing of Mr. Krebs unacceptable, adding that it caused instability at his agency as it tried to mitigate the hospital attacks amid a surging pandemic.
Administrators at the University of Vermont Health Network acknowledge that restoring services proved far more challenging than they expected.
âIf you look at what some other hospitals have gone through, it was days, not weeks,â said Al Gobeille, the systemâs executive vice president for operations. âWe thought that was what this would be. And we were wrong.â
He said a large number of professionals on information technology â 300 hospital employees, plus 10 members of the National Guard â were deployed to rebuild and clean 1,300 servers and 5,000 laptops and desktop computers. A team of seven F.B.I. investigators was on site for two days after the shutdown, he said, but has had little to no contact with administrators since then.
With the restoration of the electronic patient record system, he said, the hospitalâs systems are 75 to 80 percent recovered.
The motivation behind the attack remains unclear. At a news conference last month, Dr. Stephen Leffler, the president of the medical center, said he had received no request for ransom. Since then, though, at the request of the F.B.I., administrators have carefully avoided discussing the matter of ransom, or confirming Dr. Lefflerâs statement.
Dr. Leffler, he said, âwas saying what he knew at the time,â Mr. Gobeille said.
âThe F.B.I. has asked us not to talk about that part of the investigation, and I havenât said either way,â he said. âIâm a pretty transparent person, so itâs odd to say the F.B.I. has asked me not to talk about it. Itâs not who we are. But in this case, I understand why.â
Some patients have complained that they were left dangling, uncertain when their treatment would resume.
Sean McCaffrey, 37, who was scheduled to see a cardiologist on the afternoon of the cyberattack â he had been suffering from chest pains â said he had never been contacted to reschedule the appointment.
âItâs really troublesome because I have lost some faith in my local hospital,â he said. âI was told Iâd get a call. Itâs been three weeks, and I have no idea what to do.â
Others say they are still waiting to gain access to critical scans. Two days before the shutdown, Damian Mooney, 47, had received a radiologistâs notes on an M.R.I. of his shoulder, which suggested that an aggressive bone cancer may have returned.
The scans have been unavailable since the cyberattack, so no doctor has been able to say whether the radiologist was correct, said his wife, Kat.
âFor 26 days, weâve been sitting here going, âWe donât know whether this recurred or not,ââ she said.
It will be difficult, both for patients and staff members, to regain their sense of security, said Jennifer Long, an outpatient nurse at the medical center.
She and her colleagues, she said, sometimes wonder aloud what allowed the hackers to get into the system: âIs it the kid down the street? Is it someone in another country? Was it an email I sent? Was it the last page I opened?â
âYouâre left with that feeling â itâs kind of sickening, itâs very impersonal â knowing that this was a deliberate attack, without any regard for the consequences, and the potential for harm,â she said. âIt really stings. Itâs really hard to sit with it.â