The Grays Harbor Community Hospital in Washington State just sent notices to 85,000 patients of a ransomware attack that impacted medical records.
According to local news outlet The Daily World, the hospital and its clinics are still trying to recover from the attack, which happened two months ago and infected networks and system backups.
The hospital did not pay the ransom, which was the Bitcoin equivalent of around $1 million.
The hospital's CEO says the attack likely started with a phishing attack when an employee clicked on a link or attachment. And it occurred on a weekend, when IT staffing was reduced.
"For the first two or three days it was treated as essentially an IT problem. The technical people started turning off servers Monday morning to contain it, but in those first days it had already been widely spread."
The hospital was unable to process any medical payments for five days. Now two months after the attack, the payments are flowing again, but some medical data is not:
"The problem was worse at the clinics. Ironically, Jensen said, the hospital's older software meant the ransomware wouldn't work on the hospital's main system for managing patient information. But it was effective at the clinics, which are still hampered, CEO Jensen said, meaning medical records, including prescriptions, are still not available and records are still being kept on paper."
See the Grays Harbor Community Hospital cyber incident notification.
[RELATED: Coordinated Ransomware Attack in Texas, Response Underway]
Also, security leaders in Oregon and Washington, utilize this cybersecurity resource: 18th annual SecureWorld Seattle conference.