Rhysida group claims a major ransomware attack on Chicago pediatric hospital

The infamous Rhysida ransomware group has demanded a ransom of 60 Bitcoin from Chicago-based Lurie Children’s Hospital after disrupting the hospital’s operations with a targeted ransomware attack.

 

Earlier this month, Chicago-based Lurie Children’s Hospital said it was responding to a cyber security incident that forced it to take several systems offline. 

 

The hospital, known for its comprehensive paediatric services and catering to over 200,000 children annually, said that it was working with third party cyber security experts and law enforcement agencies to investigate the incident.

 

The cyber incident impacted crucial services, including internet, email, phone, and access to the MyChat platform. Patients requiring immediate medical attention were advised to dial 911 or visit the nearest emergency department.

 

Despite the disruptions, Lurie Children’s Hospital tried to provide uninterrupted care to its patients. However, scheduled procedures were delayed, and essential diagnostic results such as ultrasound and CT scans were inaccessible. Prescriptions were being issued in paper form, and the hospital had shifted to a first-come, first-served approach, prioritising emergency cases.

 

Though no ransomware group initially claimed responsibility for the cyber attack on the pediatric hospital, the notorious Rhysida ransomware group recently claimed responsibility for the cyber security incident and listed the hospital as a victim on its data leak site. It claims to be in possession of 600GB of data stolen from the hospital and describes it as, “exclusive, unique, and impressive.”

 

 

The group has reportedly demanded a ransom of 60 Bitcoin (approximately £2.89 million) from the hospital and gave the latter a period of six days to transfer the amount. The group also advertised the stolen data on its leak site, asking interested buyers to start bidding so as not to miss the opportunity to access exclusive data.

“With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner!” the group posted.

 

Lurie Children’s Hospital posted an update on the security incident on X on February 23, stating that it is still in the process of recovering its systems.

 

 

“At this time, MyChart is unavailable and we appreciate your patience as we work to resolve this issue. Also, due to our systems being offline, we are using manual processes that will result in longer wait times between the request and completion of prescription requests.

 

“Please know that Lurie Children’s is open and providing care to patients with as few disruptions as possible.  Patients scheduled for procedures and appointments are still being asked to arrive as scheduled unless their care provider contacts them directly to reschedule. 

 

“If you were notified that your appointment was cancelled, we will contact you to reschedule your appointment once systems have been restored,” reads the update.