City Hospital Network Fends Off Ransomware, Spurring Sector-Wide Alarm

NEW YORK — A ransomware attack that briefly threatened to lock up computer systems at a New York City hospital network last week was contained before it could disrupt patient care, but the near-miss has sent a jolt through the region's health-care sector, where administrators say cyberattacks have become a constant threat. Officials at the affected network said fast detection allowed them to isolate the intrusion, and that no patient records were confirmed stolen, though a forensic review is ongoing.

Hospitals have become prime targets for cybercriminals precisely because the stakes are so high: when systems that manage medications, imaging, and patient records go dark, care can grind to a halt, creating enormous pressure to pay ransoms quickly. "An attacker knows that a hospital can't just shut down for a week to rebuild," one health-care security consultant said. "That urgency is exactly what they're monetizing." Recent years have seen a string of disruptive attacks on hospital systems around the country.

In the local incident, security staff said they detected unusual activity on the network overnight and moved to sever affected servers from the rest of the system before the malicious software could spread. Clinicians were briefly forced onto backup procedures, including paper charting in some units, a contingency that hospital leaders credited with keeping care uninterrupted. "The drills we hated running are the reason we're not telling a very different story today," one hospital official said.

The episode has prompted other hospitals across the metropolitan area to review their own defenses, from staff training that guards against the phishing emails often used to gain entry, to the offline backups that allow a system to recover without paying. Security experts stress that no defense is impenetrable, and that resilience — the ability to keep operating and recover quickly — matters as much as prevention. Many health systems, they note, run on a patchwork of aging software that is difficult to secure.

State health and cybersecurity officials said they were coordinating with the affected network and had issued fresh guidance urging hospitals to test their incident-response plans. Regulators have increasingly treated cybersecurity as a patient-safety issue rather than a purely technical one, and some have floated stricter reporting requirements for health-care breaches. "A locked-up EHR system is a clinical emergency," one official said, referring to electronic health records.

For patients, the incident was largely invisible, which security staff described as the entire point. But administrators warned against complacency, noting that the attackers who probe hospital networks are persistent, well-funded, and constantly adapting. "We won this round," one security director said. "But we have to win every round, and they only have to win once. That math is why none of us are sleeping well."