Scripps Health continued to be significantly affected by a ransomware attack on Monday, the ninth consecutive day since hackers staggered the region’s second-largest healthcare system on May 1.
The system’s website, scripps.org, still housed just a one-paragraph message with a network outage notice, an apology, and a phone number for patients to call under the headline “Scripps.org will be back soon.”
The attack knocked out the organization’s electronic health records and other electronic systems used to provide care in hospitals and doctors’ offices, leading to ambulance diversions, canceled procedures and increases in patients at other local centers. The outage also took out of service the “My Scripps” smartphone app, which many have become accustomed to using to message their doctors, make appointments and keep track of prescriptions.
Like last week, Scripps had little to say about the situation on Monday. A single-paragraph statement repeated earlier claims that an internal investigation “is ongoing.”
“In order not to compromise the integrity of the ongoing investigation and to maintain our focus on providing the highest level of patient care, we are unable to provide additional details at this time,” the statement said.
Bulletin
Receive the latest news in Spanish Monday, Wednesday and Friday.
–
Subscribe to our newsletter
Occasionally, you may receive promotional content from the San Diego Union-Tribune en Español.
–
The silence, on both public and private channels, is beginning to irritate some Scripps patients, including Gary Miner of Carmel Valley.
Miner, director of information technology for a local law firm, said he spent 45 minutes trying to reach his doctor through the Scripps phone system on Monday before giving up. The lack of communication about how patients should act during the attack, he said, has been frustrating.
A company as large as Scripps, he said, should have a business continuity and disaster recovery plan capable of keeping information flowing even in a situation where core systems are compromised.
“What do I do and who do I trust?” Miner said. “I don’t think I’m well served going into a Scripps ER today after having been well served for 20 or 30 years.”
It’s puzzling, he said, not to hear from Scripps CEO Chris Van Gorder, a local leader known for his willingness to speak up, especially during the COVID-19 pandemic.
In general, he said, the current situation forces him to reassess the trust he has placed in the organization.
“I love my doctors, they are all phenomenal, but this is a leadership failure,” Miner said. “Not responding is not an acceptable option at all, ever.”
Because the attack is a real crime, one that is being investigated by the Federal Bureau of Investigation, Van Gorder said in an email Monday, there are significant limits to what can be said.
“It’s not a regular occurrence, and I’m limited in what I can say under the circumstances,” Van Gorder said. “We are a very ethical and legal organization, and my focus now is on patient care.”
Scripps isn’t the only large San Diego organization currently facing the fallout from a cyber attack.
On Monday, the University of California released an update to its previous statements about an infiltration that allowed hackers to download identifying information from its servers in late 2020. The breach included full names, addresses, driver’s license information, information of passport, financial information, dates of birth and other private details for current and former employees, students and others who participated in programs throughout the UC system.
The attack, which was made public for the first time on March 31, occurred on December 24, 2020 and some data was subsequently published on the internet. The university has directly notified those it knows were affected, offering each of them free credit monitoring and identity theft protection services.
The University of California was one of hundreds of organizations affected by a known vulnerability in the Accellion File Transfer Appliance. Some organizations have subsequently reported that personal information has been used to attempt to extort money directly from individual victims.
The university has declined to say how many people have been affected across its campuses or at UCSD in particular. A UCSD official said in an email Monday that UC San Diego Health and its patients were not affected.
–
