Ransomware shutdown continues to be a problem for Scripps Health

A ransomware attack continued to plague Scripps Health on May 3, creating confusion for patients and their families, especially those who were scheduled for appointments this week.

After fighting to regain control of its systems since the incident occurred May 1, Scripps said two days later that it still had not resolved the technical terrorism that put its patient records, scheduling and other critical systems offline, forcing medical personnel in hospitals and other facilities to revert to paper for the time being.

No specific timeline for when things might be back to some semblance of normal was offered.

News

Scripps Health targeted by cyberattack

The hospital system, which includes La Jolla, was hit in an attack that forced it to block patient access to online portals and divert some critical-care patients.

May 2, 2021

Scripps has not yet confirmed that ransomware — malicious software that is capable of holding digital assets hostage under a demand for cash — caused the outage. However, The San Diego Union-Tribune obtained an internal memo that implicates that particular attack route, which also apparently affected Scripps’ backup servers in Arizona.

Internet forums were filled with Scripps patients seeking more information on when they might be able to learn more about what would happen with appointments made before the weekend.

Noah Tyler said he was scheduled for an esophageal diagnostic procedure and was to receive the location of the appointment over the weekend through Scripps’ electronic patient portal. But access to that scheduling system flatlined after the attack, and calls to Scripps’ after-hours help line May 2 made it clear that no one had access to the scheduling system.

“They couldn’t even look up basic information. They were obviously flabbergasted,” said Tyler, of Carlsbad.

Finally, about 45 minutes before his appointment was to begin May 3, he said, he received a call from Scripps indicating that all imaging and appointments involving X-rays were being canceled.

“I’m not really sure how they managed to know that I had an appointment scheduled, because they didn’t yesterday,” Tyler said. “It’s just surprising to me how much of their system has been totally affected without the ability to fall back on something.”

The attack forced the health system’s four main hospitals to switch to paper records for their existing patients as emergencies including trauma, heart attacks and strokes were diverted to other hospitals.

Quentin Clark said his mother, Ruth, was admitted to Scripps Memorial Hospital La Jolla for monitoring on April 30 after experiencing dizziness and other heart-related symptoms.

A procedure was about to get underway when the outage happened the next day, taking away access to patient records. The record of Ruth’s negative coronavirus test was part of her digital patient record, meaning it was unavailable. She had to undergo a second test, the kind that requires a deep nasal swab.

Otherwise, though, Clark said the procedure went smoothly.

Though the hospital’s digital network remained offline, he said the medical team was still able to get diagnostic head images to ensure there was no bleeding.

The experience, he said, emphasized that while technology is pervasive, it’s the people who really count.

“I didn’t really notice a lot of drop in care at all,” said Clark, of Mount Helix. “I was really happy with the way the staff was handling my mother’s situation.”

But it was clear, he added, that things were still locked up at Scripps on May 3. It was impossible to schedule a follow-up appointment with his mother’s doctor.

Bryan Wilson and his wife, Alexa, arrived at Scripps Memorial Hospital Encinitas with her in labor early May 2 and noticed that, while “nobody was in panic mode,” none of the computers in the facility’s emergency department appeared to be turned on, except for one that displayed a clear error message.

Nobody mentioned the possibility of a ransomware attack, Wilson said, until he saw a mention on social media.

With the hospital’s network down, electronic vital sign monitoring was not functional, and a nurse was assigned to record the information manually.

Overall, Wilson said, the experience went smoothly, with the couple’s daughter, Liliana, born at about 5 a.m.

Though the hospital’s food ordering system was still down the morning of May 3, generic rather than custom meals were delivered a little late.

“Other than that, the delivery went great,” Wilson said in an email.

The attack so pervasively affected operations that even coffee drinkers didn’t catch a break.

On May 3, Scripps employees looking for a caffeine fix or quick bite had to pay cash at the cafe outside Scripps Memorial La Jolla because the electronic system that usually allows them to pay by tapping an ID badge was out of order. A makeshift sign scribbled on a note card placed behind the tip jar read “Payroll down,” followed by a sad face.

Earlier that morning, Scripps issued an announcement warning staff members not to log on to their computers, according to an imaging technician who requested anonymity. Instead, staff was maintaining paper records.

A handwritten sign at Scripps Memorial Hospital La Jolla on May 3 indicates cash-only cafe purchases due to a cyberattack.

(Jonathan Wosen / The San Diego Union-Tribune)

The employee added that some of the patients she had spoken with already knew about the cyberattack from local news reports, while others were hearing about it for the first time. Of those who knew about the situation, some received phone calls from Scripps letting them know they could still come in for their appointment.

“Some appointments we’re able to keep and some we had to cancel,” she said. “But they’re doing their best.”

Scripps said in a statement that it is reaching out to patients with appointments scheduled for the next few days. People unsure about their status can call (800) 727-4777.

— San Diego Union-Tribune staff writer Jonathan Wosen contributed to this report by San Diego Union-Tribune reporter Paul Sisson. ◆