After detecting the security incident on May 1, Scripps Health suspended user access to its IT applications, including its online patient portal and scripps.org. As of Monday, the website continues to display an error message.
“We apologize for any inconvenience and are working diligently to restore our systems as quickly and as safely as possible,” read a statement posted to the system’s Facebook page on May 12.
Scripps has been largely tight-lipped about the details of the attack, with CEO and President Chris Van Gorder describing it in a May 10 internal memo as a cybersecurity incident “with malware placed on our information system.”
“I want you to know this is a different kind of situation which limits what and when I can say things. We need to let our investigation proceed and work with our consultants and outside governmental agencies, and when I can share, I will,” Van Gorder wrote in the memo.
“I do want you to know that this malware attack targeted our information systems. At this time, we have no reason to believe individual data incidents affecting employees, physicians or patients are related to our current incident,” he added.
Independent sources have told local outlets the incident involved ransomware. Experts speculate that’s related to why the network outage is ongoing.
“It’s likely that it’s taking a long time because of negotiations going on with the perpetrators, and the prevailing narrative is that they have the contents of the electronic health records system that are being used for ‘double extortion,'” said Michael Hamilton, former chief information security officer for the city of Seattle and CISO of healthcare cybersecurity firm CI Security.
“As the disclosure of these records would cause more financial harm to Scripps, these negotiations are likely being carried out carefully to minimize additional damage to the organization as well as the cost of returning to full operation,” Hamilton continued. “There is also an ongoing investigation, which permits Scripps to embargo information right now,” he added.
Scripps Health did not respond to email requests for comment. Attempts to contact the health system via phone were unsuccessful.
In the May 12 Facebook post, Scripps reminded patients that all its locations – including its hospitals, urgent cares, emergency departments, Scripps HealthExpress, Scripps Clinic, and Scripps Coastal – are open and continuing to provide care. Virtual visits are still taking place, and Scripps has partnered with Labcorp and Quest Diagnostics to help provide laboratory systems.
The post also directed patients to mail requests for medical records to the system’s Release of Information Department via a PO Box in Encinitas.