Universal Health Services reports $67 million in losses after apparent ransomware attack

Cybercrime has been costly to the health sector during the pandemic.

An apparent ransomware attack last fall caused $67 million in pre-tax losses at Universal Health Services, the U.S. health care provider has revealed, illustrating the sharp financial toll that criminal hackers have caused the sector during the pandemic.

The Sept. 27 breach at Universal Health Services (UHS) was widely reported to be a ransomware attack, with some analysts saying it involved the Ryuk strain of malicious code. It came amid a wave of suspected Ryuk incidents at the computer networks of various U.S. hospitals that federal authorities scrambled to address.

UHS, which oversees 400 hospitals and calls itself one of the biggest health care providers in the country, now says the cost of the breach included lost revenue because ambulances were diverted to competitor facilities. The incident also delayed billing procedures for more than two months, and forced UHS to spend big on labor costs to restore connectivity, the company said in a Feb. 25 earnings statement. Coding and billing delays caused by the hack carried into December.

Data breaches cost health care companies on average more than $7 million per incident, according to a 2020 IBM study. A slew of ransomware attacks during the pandemic has only put more pressure on a sector dealing with a shortage of security personnel. Alejandro Mayorkas, the newly minted Homeland Security secretary, has pledged more government resources to fight ransomware.

UHS, which reported more than $3 billion in revenue in the fourth quarter, suggested its insurance provider would cover a significant chunk of the losses. Under the company’s cyber-insurance policy, it said, “we believe we are entitled to recovery of the majority of the ultimate financial impact resulting from the cyberattack.” (A UHS spokesperson did not respond to a request for comment on the company’s insurance policy.)

Smaller clinics sometimes fare far worse. Wood Ranch Medical, a health care clinic in California, said it would have to close after a 2019 ransomware attack cut off access to patient records.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure