Restoring hospitals systems following cyberattack will take weeks

Windsor Regional Hospital CEO David Musyj said Thursday it will take weeks to restore systems — from staff payroll to patient procedures — following a cyberattack against five southwestern Ontario hospitals.

“This is not something you can do overnight,” Musyj said during a hospital board meeting. “This will take time. This will take weeks. We are hopeful that over the next few weeks we will be able to bring back key clinical applications one by one. Our collective focus is on cancer patients and getting those systems up quickly but safely. And we are making substantial progress.”

Article content

Article content

The criminals, believed to be members of a cybercrime organization called Daixin Team, stole hospital staff and patient information and has started publishing it on the dark web.

Sarnia’s Bluewater Health, Chatham-Kent Health Alliance, the Windsor-Essex Hospice, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, and Windsor Regional Hospital were all victims of the cyberattack.

The hackers hit the hospitals by targeting the TransForm Shared Service Organization, which runs technology systems for all five facilities.

Musyj said the hospitals confirmed they were under a cyberattack the morning of Oct. 23. He said Windsor Regional Hospital immediately engaged a security threat team that was already on contract for such events.

“To contain the incident and prevent further harm, we had to shut down our IT systems,” he said.

The hospitals said they are also working with various cybersecurity professionals and police agencies including INTERPOL and the FBI.

“We are doing our very best to recover as safely and quickly as possible,” said Musyj. “And we are not doing this alone. We are working with experts who have been involved in hundreds of these cyerbattacks. We are in non-stop discussions with other hospitals and Ontario Health. We have seen the very best of Ontario come to our aid, just as Windsor Regional Hospital did for others during the pandemic.”

Article content

In addition to the data theft, the ransomware attack also blocked the hospitals’ access to Wi-Fi, email, and patient information systems. Procedures had to be postponed and hospital staff went back to using paper charts. Some of the hospital websites were still down on Thursday.

Windsor Regional Hospital was forced to start sending patients requiring radiation treatment out of town for care.

Musyj said no ambulatory surgical procedures were delayed because of the cyberattack.

“After the first few days, scheduled surgeries are now nearly back to 100 per cent,” he said. “We are also making substantial progress on curative radiation treatment started back safely and should be able to make some announcements over the next few days.”

Musyj said his hospital’s frontline payroll team has been able to ensure all staff continue to be paid during the turmoil by pulling together data from different sources.

“Needless to say the last 11 days have been a test for our patients, community and staff,” Musyj told board members. “A test that I believe our staff is passing.”

When the crisis is over, he said there will be an investigation into what went wrong and how the situation can be avoided in the future.

“We are sharing information as it becomes available and on our experts’ advice,” he said. “There will be a time, after we safely resume critical care, to do a root cause analysis and learn from this. We will learn and improve and help other institutions prepare.”

twilhelm@postmedia.com

twitter.com/WinStarWilhelm

Article content