A “known criminal threat actor” accessed Lurie Children’s Hospital’s electronic network, hospital officials said Thursday, as phone and email outages at the Near North Side facility stretched into their ninth consecutive day.
The hospital became aware of the threat on Jan. 31 and “consistent with best practices” took systems offline, including phone, email, electronic medical records and MyChart, officials said at a news conference at the hospital at 225 E. Chicago Ave.
“We did this in an effort to protect the information of our patients, workforce and organization at large,” said Dr. Marcelo Malakooti, chief medical officer.
But hospital officials provided no specifics on the “known criminal threat actor” behind the communication breakdown — and declined to answer any of reporters’ questions at the news conference.
Officials at the hospital at 225 E. Chicago Ave. said they are working with the FBI, other law enforcement and internal experts to resolve the issue.
“As an academic medical center, our systems are highly complex, and these incidents can take time to resolve,” Malakooti said.
“FBI Chicago is aware of the recent cybersecurity incident affecting Lurie Children’s Hospital and is utilizing all available investigative tools and resources to provide assistance,” the FBI said in a statement Wednesday.
“As always, our attention remains on ensuring the safety of our citizens and our nation’s critical infrastructure. There is no additional information available for release at this time.”
Dr. Eric Chan-Tin, associate professor of computer science at Loyola University Chicago, told the Sun-Times Wednesday that without more information, it’s hard to know exactly what Lurie Children’s is dealing with. He said they could be dealing with a ransomware attack or hackers.
Depending on the severity of the issue, Chan-Tin said it could take weeks or months for the hospital to recover.
“Hospitals are good targets for hackers because they are critical infrastructure and they have a lot of private data, which is worth a lot of money,” he said.
All Lurie Children’s locations have remained open during the outage, said Brian Stahulak, chief nursing officer.
Lurie Children’s hospital established a call center Friday as part of the hospital’s cyberattack protocols, but some parents complained of difficulty getting through to the call center.
The call center can be reached at (800) 543-7362 for non-urgent patient questions, information about scheduled appointments and prescription refill requests. The hotline operates 8 a.m. to 6 p.m. Monday through Friday and 8 a.m. to 5 p.m. Saturday. The hotline is closed Sunday.
When the call center is closed, the main operator can be reached at (312) 227-4000, though the hospital noted it was receiving a high number of calls.
“We recognize the frustration and concern this situation creates for all those impacted. We are so grateful to our Lurie Children’s community for the outpouring of support,” Malakooti said.
“We will continue to share our updates as they become available,” he said.
Editor’s Note: The call center hours were updated Friday according to a statement from Lurie Children’s Hospital.
