Cyberattack Throws Southern California Hospital System Offline for Days

A hospital system in Southern California was forced to temporarily modify its patient care procedures after it was targeted by a cyberattack.

Scripps Health, which has five hospital campuses and several other outpatient facilities spread throughout San Diego County, first alerted the public about the attack on Sunday.

In a statement shared with local media, the hospital system said it moved its information technology programs offline in response to the attack, which it identified on May 1. Doing so meant that employees who typically have access to those programs while treating patients at the hospital campuses, as well as off-campus patients trying to access their patient portals online, were unable to get through.

Scripps Health employees had to rely upon alternative methods while caring for patients, which included "offline documentation methods," the hospital system said.

Scripps Health said on Sunday patient care "continues to be delivered safely and effectively" in spite of the cyberattack.

Even so, the hospital system said it was rescheduling some patient appointments initially set for Sunday and Monday, though Scripps Health's urgent care and emergency departments were still open for patients with immediate needs.

Scripps Health's website remained offline Monday afternoon.

"Our technical teams and vendor partners are working tirelessly to resolve issues related to the cyberattack as quickly as possible," Scripps Health said in a statement provided to Newsweek on Monday.

According to the statement, Scripps Health's facilities were open to patients, but the hospital system was still working to reschedule some appointments and encouraged those unsure about their appointment status to call their hospital campuses directly.

Scripps Health did not detail the type of cyberattack it endured, what information attackers may have accessed, or whether suspected actors had been identified. The hospital system said it was working with law enforcement and relevant government organizations to respond to the attack, but declined to specify the organizations with which it was in contact.

Scripps Health declined to comment on the cyberattack beyond its updated public statement.

On Sunday, The San Diego Union-Tribune and KNSD-TV reported that some patients with life-threatening conditions were taken to other hospitals in what appeared to be a cautionary step as Scripps Health responded to the cyberattack. Monday requests from around the county for emergency medical services "continue to be met in San Diego County while Scripps Health recovers from a weekend cyber-attack," a county official told Newsweek.

"The emergency healthcare system is less stressed now than it was during the heights of COVID, and the public should be reassured that emergency response needs are being met," the county official added.

Cyberattacks on healthcare systems occurred several times over the last year, according to The New York Times. The uptick in cyberattacks on hospitals comes amid a surge in cyberattacks in the U.S. and around the world.

In response to that surge, which have targeted public and private organizations, U.S. Department of Homeland Security (DHS) Secretary Alejandro Mayorkas took the step earlier this spring to designate ransomware attacks as a "threat to national security."

A ransomware task force comprised of experts from the public and private sectors presented a report last week that offered tips on how to prevent and respond to ransomware attacks.

Speaking at the beginning of a virtual presentation during which the report was presented, Mayorkas acknowledged recent efforts by the U.S. Department of Justice and the White House to combat ransomware, and said the DHS also planned to work closely with those behind the task force's report to "turn its recommendations into action."