Cybersecurity Event Update
Regional Updates
-
Whose and what data is impacted? Is mine?
Right now, we don’t know precisely what data was potentially affected and for which patients or associates. In order to reach those conclusions, we need to conduct a full review of the files that may have been impacted and carefully analyze them. While we have started this process, it is a significant undertaking that will take time.
-
What should I do?
We encourage all Ascension patients and staff who are concerned to take advantage of our complimentary credit monitoring and identity theft protection services. We want to be clear, however, that this offer does not mean we have determined that any specific individual patient’s data has been compromised. Rather, it illustrates our desire to do everything possible to reassure our patients and associates, regardless of any impact to specific individuals’ data.
-
How do I sign up for free credit monitoring?
Individuals who wish to enroll in free credit monitoring and identity theft protection services should call the Ascension Incident Response Line at 888-498-8066, where you will speak to a representative who will provide you with a unique enrollment code. Once you receive the code, the representative can transfer you to another representative who can enroll you in credit monitoring over the phone using your unique enrollment code. Alternatively, they can direct you to the website to enroll online with your unique enrollment code.
-
When will you know whose data was specifically impacted?
We need to conduct a full review of the files that may have been impacted and carefully analyze them. While we have started this process, it is a significant undertaking that will take time. Once our data analysis is complete, however, we are committed to following all applicable laws and regulations to notify affected individuals and the appropriate regulatory bodies.
-
Should I be concerned that I am at risk of fraud as a result of this incident?
We have no evidence at this time that any patient or associate is at greater risk of fraud as a result of this incident. Rather, we are making this complimentary service available out of a desire to do everything possible to reassure our patients and associates, regardless of any impact to specific individuals’ data.
-
What happened?
On May 8, Ascension detected unusual activity in our network systems, which we have determined is due to a ransomware attack. We continue to diligently investigate and address this ransomware attack, working closely with industry-leading cybersecurity experts to assist in our investigation and recovery efforts.
-
What services are impacted?
Ascension has successfully restored Electronic Health Record (EHR) access across our ministries. As a result, patients in our hospitals and clinics should see improved efficiencies in appointment scheduling, wait times for appointments and prescription fulfillment. Additionally, access to patient portals have been restored in each community we serve.
However, please note that medical records and other information collected between May 8 and the date of local EHR restoration may be temporarily inaccessible as we work to update the portal with information collected during the system downtime. For record availability during that time frame, please contact your clinician’s office. Please note that, due to high volumes, responses to portal messages may experience a slight delay.
-
What are downtime procedures?
Downtime procedures are safe clinical practices born out of necessity. They are predefined steps that all healthcare organizations follow during a system or network failure developed in case of a potential threat. We are taking all necessary precautions at this time and our downtime procedures require our highly qualified, dedicated medical, nursing and clinical teams to utilize manual processes to ensure patients are properly cared for.
Manual processes including moving to paper records and processing everything by hand are being utilized for varying clinical processes including dispensing medication, inputting health medical records, ordering and completion of diagnostic tests and procedures, contacting patients and sharing information securely.
-
Can my doctor or caregiver access my medical history or write me a prescription?
Yes, clinicians can access medical records electronically as they did prior to this incident. Additionally, now that electronic health record (EHR) access has been restored across our ministries, patients should see improved efficiencies in appointment scheduling, wait times for appointments and prescription fulfillment.
-
When will the restoration be complete?
Our restoration work will take time, and we do not have a timeline for completion. We will continue to provide updates as appropriate.
-
When will the investigation be complete?
Investigations of this nature take time to complete. While we are not able to provide an exact timetable, we will continue to provide updates as appropriate. These updates can be found on our website at https://about.ascension.org/cybersecurity-event.
-
What do patients need to know and do?
Caring for our patients remains our highest priority. We understand there may be concerns, but our workforce is well trained in providing patient care with established downtime procedures.
Our teams are working directly with any patient whose appointment or procedure will need to be rescheduled. Unless instructed otherwise by their care team, patients should continue to attend appointments as scheduled.
-
I have an onsite appointment, should I still go?
Yes. Our hospitals and facilities remain open and are providing care. Caring for our patients remains our highest priority. We understand there may be concerns, but our workforce is well trained in providing patient care with established downtime procedures.
Our teams are working directly with any patient whose appointment or procedure will need to be rescheduled. Unless instructed otherwise by their care team, patients should continue to attend appointments as scheduled.
-
Are Ascension locations still accepting patients?
Our hospitals and facilities remain open and are providing care. Safely caring for our patients remains our highest priority as we navigate this cybersecurity incident.
-
What if I have an emergency or need an ambulance?
Our hospitals and facilities, including emergency departments, remain open and are providing care. Caring for our patients remains our highest priority. We understand there may be concerns, but our workforce is well trained in providing patient care with established downtime procedures.
If you are experiencing a medical emergency, please contact 911 and your local emergency services will bring you to the nearest hospital emergency room.
-
I am currently hospitalized – should I be concerned?
Caring for our patients remains our highest priority. We understand there may be concerns, but our workforce is well trained in providing patient care with established downtime procedures.
-
Can I access my patient portal?
Yes. All Ascension patients can now access their patient portal. However, medical records and other information collected between May 8 and the date of local EHR restoration may be temporarily inaccessible as we work to upload the information collected during the system downtime. For record availability during that time frame, please contact your clinician's office directly. Please note that, due to high volumes, response to portal messages may experience a slight delay.
-
Can I fill my prescriptions at Ascension pharmacies?
Yes, Ascension Rx Pharmacies can process and ship prescriptions. Please note that there may be a slight delay in processing and shipping at this time.
-
Why is it taking so long to reach my clinic?
This is because we are experiencing higher than average call volumes. We look forward to serving you as soon as we are able. If you continue to have concerns, you can call our national call center at 1-888-493-4817, and we will do our best to assist you. If you are experiencing a medical emergency, please dial 911, and local emergency services will transport you to the most appropriate hospital emergency room.
-
Is the SmartHealth app functional?
Your SmartHealth app is available again. However, some recent claims may be delayed in appearing in the app.
-
June 12, 2024 - 10:45am CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
June 12 - 10:45am CT
“We have made progress in our investigation and recovery with the help of third-party cybersecurity experts. At this point, we now have evidence that indicates that the attackers were able to take files from a small number of file servers used by our associates primarily for daily and routine tasks. These servers represent seven of the approximately 25,000 servers across our network. Though we are still investigating, we believe some of those files may contain Protected Health Information (PHI) and Personally Identifiable Information (PII) for certain individuals, although the specific data may differ from individual to individual.
We have also identified how the attacker gained access to our systems. An individual working in one of our facilities accidentally downloaded a malicious file that they thought was legitimate. We have no reason to believe this was anything but an honest mistake.
Importantly, we have no evidence that data was taken from our Electronic Health Records (EHR) and other clinical systems, where our full patient records are securely stored.
Right now, we don’t know precisely what data was potentially affected and for which patients. In order to reach those conclusions, we need to conduct a full review of the files that may have been impacted and carefully analyze them. While we have started this process, it is a significant undertaking that will take time. In the meantime, to provide our patients and associates with the greatest peace of mind possible, we are offering complimentary credit monitoring and identity theft protection services to any Ascension patient or associate who requests it, free of charge, and regardless of whether we determine in the future that their data was actually involved in this incident.
Individuals who wish to enroll in free credit monitoring and identity theft protection services should call our dedicated call center at 1-888-498-8066.
We encourage all Ascension patients and staff who are concerned to take advantage of these services. We want to be clear, however, that this offer does not mean we have determined that any specific individual patient’s data has been compromised. Rather, it illustrates our desire to do everything possible to reassure our patients and associates, regardless of any impact to specific individuals’ data.
We understand individuals may have questions about their data, including whether it was affected, but at this point we are not able to answer those questions on an individual basis. Once our data analysis is complete, however, we are committed to following all applicable laws and regulations to notify affected individuals and the appropriate regulatory bodies. To our patients, associates and the communities we serve, we regret any disruption or concern you may have experienced as a result of this incident.”
-
June 11, 2024 - 1:30pm CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
June 11 - 1:30pm CT
Ascension is pleased to report that we have successfully restored EHR access in
- Florida
- Alabama
- Tennessee
- Maryland
- Central Texas (Ascension Seton and Dell Children's hospitals)
- Oklahoma
- Wisconsin
- Illinois
- Kansas
- Part of Michigan (Genesys, Rochester, Saginaw, Tawas)
- Part of Indiana (Evansville)
We are still working toward completing Electronic Health Record (EHR) restoration across our ministry by June 14th.
As EHR is restored across the entirety of our network, clinicians will be able to access patient records electronically as they did prior to this incident. Patients who receive care in those markets can also access their patient portal, as they normally would.
However, please note that medical records and other information between May 8th and the date of local EHR restoration may not be accessible as we work to upload the information collected during the system downtime. For record availability during that time frame, please contact your clinician's office. Please note that, due to high volumes, responses to portal messages may experience a slight delay.
We sincerely thank our patients and community for your support and to our dedicated clinicians who continue to provide quality care.
-
June 7, 2024 - 4:00pm CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
June 7 - 4:00pm CT
Ascension continues to work expeditiously alongside industry-leading cybersecurity experts in our efforts to safely restore systems across our network. Please know our hospitals and facilities remain open and are providing patient care. Patients should continue to visit the regional updates portion of this webpage for the latest information on a state-by-state basis.
Ascension continues to make progress in our efforts to safely restore systems across our network. Restoring our Electronic Health Record (EHR) continues to be among one of the top priorities of our recovery process.
To date, we have successfully restored EHR access in our Florida, Alabama, Tennessee, Maryland, Central Texas (Ascension Seton and Dell Children's hospitals), and Oklahoma markets. We are still working toward completing EHR restoration across our entire ministry by June 14.
For patients who receive care in Florida, Alabama, Tennessee, Maryland, Central Texas, and Oklahoma, access to your patient portal has been restored. However, please note that medical records and other information between May 8th and June 6th may not be accessible as we work to update the portal with information collected during the system downtime. For record availability during that time frame, please contact your clinician's office. Please note that, due to high volumes, responses to portal messages may experience a slight delay.
Thank you to our patients and community for your patience and support, and to our dedicated clinicians who continue to provide quality care.
-
June 5, 2024 - 9:25am CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
June 5 - 9:25am CT
Ascension continues to work expeditiously alongside industry-leading cybersecurity experts in our efforts to safely restore systems across our network. Please know our hospitals and facilities remain open and are providing patient care. Patients should continue to visit the regional updates portion of this webpage for the latest information on a state-by-state basis.
As we have previously communicated, restoring Electronic Health Record (EHR) access has been among the top priorities of our recovery process. We are encouraged to report positive developments in these efforts and can announce that we have successfully restored EHR access in our Florida, Alabama, Tennessee, Maryland, and Central Texas (Ascension Seton and Dell Children's hospitals) markets.
Based on what we have learned about this process to date, we are working toward completing EHR restoration across our entire ministry by the end of the week ending June 14.
As EHR is restored across the entirety of our networks, clinicians will be able to access patient records as they did prior to this incident. While these are promising developments in our recovery efforts, our investigation into this incident remains ongoing, along with the remediation of additional systems. This is a complex process, and it will still take time to complete.
Additionally, Ascension Rx retail, home delivery and specialty pharmacy sites are now open and able to meet your prescription needs. This means that healthcare providers are able to transmit prescriptions electronically and can send prescriptions to Ascension Rx pharmacies for their patients.
Finally, we again want to thank our patients and community for your support through this time and to our dedicated clinicians who continue to provide quality care.
-
June 4, 2024 - 6:00am CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
June 4 - 6:00am CT
Ascension continues to work expeditiously alongside industry-leading cybersecurity experts in our efforts to safely restore systems across our network. Please know our hospitals and facilities remain open and are providing patient care. Patients should continue to visit the regional updates portion of this webpage for the latest information on a state-by-state basis.
As we have previously communicated, restoring Electronic Health Record (EHR) access has been among the top priorities of our recovery process. We are encouraged to report positive developments in these efforts and can announce that we have successfully restored EHR access in our Florida, Alabama and Austin markets.
Based on what we have learned about this process to date, we are working toward completing EHR restoration across our entire ministry by the end of the week ending June 14.
As EHR is restored across the entirety of our networks, clinicians will be able to access patient records as they did prior to this incident. While these are promising developments in our recovery efforts, our investigation into this incident remains ongoing, along with the remediation of additional systems. This is a complex process, and it will still take time to complete.
Additionally, Ascension Rx retail, home delivery and specialty pharmacy sites are now open and able to meet your prescription needs. This means that healthcare providers are able to transmit prescriptions electronically and can send prescriptions to Ascension Rx pharmacies for their patients.
Finally, we again want to thank our patients and community for your support through this time and to our dedicated clinicians who continue to provide quality care.
-
May 29, 2024 - 6:25pm CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
May 29 - 6:25pm CT
Ascension continues to work around the clock with industry-leading cybersecurity experts to safely restore systems across our network. Please know our hospitals and facilities remain open and are providing safe care. Patients should continue to monitor the regional updates portion of this webpage for the latest information on a state-by-state basis.
Restoring Electronic Health Record (EHR) access has been among the top priorities of our recovery process. Due to the hard work of our teams over the past several days, we have successfully restored EHR access in our first market and are actively progressing a plan to restore access across our network on a rolling basis.
We want to sincerely thank our patients and community for your support and to our dedicated clinicians who continue to provide quality care.
-
May 24, 2024 - 8:49am CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
May 24 - 8:49am CT
Ascension continues to work around the clock with industry-leading cybersecurity experts to safely restore operations across our network. We are hopeful that after the weekend, our patients and clinicians will see progress across our points of care. Many of our vendors and partners have also started the process of reconnecting to our network and resuming services with Ascension, which should help to accelerate our overall recovery.
Until that time, please know that our hospitals and facilities remain open and are providing care. Patients should continue to monitor the regional updates portion of this webpage for the latest information on a state-by-state basis.
We also want to extend a sincere note of gratitude to our dedicated clinicians who are providing care under challenging circumstances. The compassion and resilience you have displayed throughout this event is truly remarkable and is emblematic of Ascension’s mission to improve the health of the individuals and communities we serve.
-
May 21, 2024 - 8:45am CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
May 21 - 8:45am CT
Ascension continues to work with industry-leading cybersecurity experts to investigate the recent ransomware attack and to rebuild and restore our systems securely. While this process continues in earnest, our hospitals and facilities remain open and are providing care. Patients should continue to monitor the regional updates portion of this webpage for the latest information on a state-by-state basis.
Today, we also kicked off a series of regular touchpoints with our critical partners and vendors in order to provide them with important information to assist with restoring their connection to the Ascension network. As we make progress in both restoring operations and reconnecting our partners into the network, we will continue to relay both general and state-by-state updates on this page. Please check back regularly for new information.
Thank you for your support as we continue to respond to this incident.
-
May 15, 2024 - 4:23pm CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
May 15 - 4:23pm CT
Ascension continues to make progress towards restoration and recovery following the recent ransomware attack. We continue to work with industry leading forensic experts from Mandiant to conduct our investigation into this attack and understand the root cause and how this incident occurred. In parallel, we have brought in additional cybersecurity experts from Palo Alto Networks Unit 42 and from CYPFER to help supplement our rebuild and restoration efforts. We are focused on getting systems back up and running as safely and as quickly as possible. We are also working on reconnecting with our vendors with the help of our recovery experts. Please be aware that it may still take some time to return to normal operations.
Our priority remains providing quality patient care and relaying up-to-date information when available as we work through this recovery process. Please continue to refer to this website page along with the regional update pages for more information. We encourage anyone seeking information surrounding the incident or with questions about the operational status of Ascension facilities to visit this page for the latest updates.
As we continue to progress in these recovery and restoration efforts, we want to express a sincere thank you to our patients and community for your patience and support through this difficult time.
-
May 13, 2024 - 4:30pm CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
May 13 - 4:30pm CT
Ascension previously reported that it experienced a ransomware attack that has caused disruptions to patient care in its network. Our priority remains on providing safe patient care. Ascension, with the support of leading cybersecurity experts, worked around the clock over the weekend to respond to the ransomware incident affecting our systems. We are focused on restoring systems safely. We are making progress, however, it will take time to return to normal operations. As systems and services come back online, we will share those updates so that our patients and communities can plan accordingly. We have established a dedicated website to share any updates we have across our system. We will be expanding the site this week to provide updates related to healthcare services as they relate to specific regions.
-
May 11, 2024 - 2:00pm CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
May 11 - 2:00pm CT
We continue to diligently investigate and address the recent ransomware incident, working closely with industry leading cybersecurity experts to assist in our investigation and restoration and recovery efforts. Additionally, we have notified law enforcement, as well as government partners including the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), and the American Hospital Association (AHA). We remain in close contact with the FBI and CISA, and we are sharing relevant threat intelligence with the Health Information Sharing and Analysis Center (H-ISAC) so that our industry partners and peers can take steps to protect themselves from similar incidents.
While our restoration work continues in earnest, our focus is on restoring systems as safely as possible. While we expect this process will take time to complete, we are making progress and systems are being restored in a coordinated manner at each of our care sites. We will continue to share updates on our recovery process.
-
May 9, 2024 - 5:30pm CT
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson".
On May 8, Ascension detected unusual activity in our network systems. We have determined this is a cybersecurity incident. We are working around the clock with internal and external advisors to investigate, contain, and restore our systems following a thorough validation and screening process. Our investigation and restoration work will take time to complete, and we do not have a timeline for completion.
Safely caring for patients remains our highest priority as we navigate this cybersecurity incident. We are actively supporting our ministries as they continue to provide safe, patient care with established downtime protocols and procedures, in which our workforce is well trained. It is expected that we will be utilizing downtime procedures for some time. Patients should bring to their appointment notes on their symptoms and a list of current medications and prescription numbers or the prescription bottles so their care team can call in medication needs to pharmacies.
Systems that are currently unavailable include our electronic health records system, MyChart (which enables patients to view their medical records and communicate with their providers), some phone systems, and various systems utilized to order certain tests, procedures and medications. We have implemented established protocols and procedures to address these particular system disruptions in order to continue to provide safe care to patients. Out of an abundance of caution, however, some non-emergent elective procedures, tests and appointments have been temporarily paused while we work to bring systems back online. Our teams are working directly with any patient whose appointment or procedure will need to be rescheduled. We understand the frustration this may cause and sincerely regret any inconvenience to our patients.
Due to downtime procedures, several hospitals are currently on diversion for emergency medical services in order to ensure emergency cases are triaged immediately. If you are experiencing a medical emergency, please contact 911 and your local emergency services will bring you to the nearest hospital emergency room.
We are beyond grateful for the hard work and dedication of our care teams across the system, and their continued commitment to our patients. We also thank our patients and our community for their continued support and patience during this time as we work through a diligent, time-intensive process to restore systems as quickly, and as safely, as possible. To ensure all patients, staff, and stakeholders are kept informed during this event, we will continue to post updated information on our website as it becomes available.
-
May 9, 2024
Cybersecurity Event Update
Note for Media: The statement below can be attributed "to an Ascension spokesperson". For updates, please visit about.ascension.org/cybersecurity-event
On Wednesday, May 8, we detected unusual activity on select technology network systems, which we now believe is due to a cybersecurity event. At this time we continue to investigate the situation. We responded immediately, initiated our investigation and activated our remediation efforts. Access to some systems have been interrupted as this process continues.
Our care teams are trained for these kinds of disruptions and have initiated procedures to ensure patient care delivery continues to be safe and as minimally impacted as possible. There has been a disruption to clinical operations, and we continue to assess the impact and duration of the disruption.
We have engaged Mandiant, a third party expert, to assist in the investigation and remediation process, and we have notified the appropriate authorities. Together, we are working to fully investigate what information, if any, may have been affected by the situation. Should we determine that any sensitive information was affected, we will notify and support those individuals in accordance with all relevant regulatory and legal guidelines.
We are reaching out to our business partners to ensure they are aware of the situation so they can take appropriate steps to safeguard their systems. We encourage all business partners to coordinate with the Ascension Technology partners to address any specific questions.
This is an ongoing situation and we will provide updates on our website as we learn more.