Toronto’s Hospital for Sick Children, Canada’s largest pediatric health center, is still recovering from a ransomware attack that began on December 18.
The hospital, which is attached to the University of Toronto, initially said the attack affected several network systems but did not discontinue patient care.
Despite that, the healthcare organization declared the incident a “code grey” – which they said represented a “system failure.”
Officials later confirmed that it was a ransomware attack but said there was “no evidence” that the personal information of patients had been compromised.
“At this time, the incident appears to have only impacted a few internal clinical and corporate systems, as well as some hospital phone lines and webpages. Downtime procedures have been activated where needed,” the hospital said.
Government agencies were notified and third party experts were hired to handle the response. Some of the hospital’s web pages were down and phone systems were having issues handling calls.
The organization did not respond to requests for comment but has been providing updates on its website and Twitter feed since the attack was first announced.
On December 23, the hospital confirmed that it would take weeks before all of their systems were functioning normally. Clinical and operational teams are implementing backup procedures for systems that are not yet accessible, the hospital explained.
The attack affected doctors’ ability to access lab and imaging results, causing extended wait times for patients. The processes around sending prescriptions were also impacted.
“The Code Grey is affecting our internal timekeeping system. The SickKids Human Resources team has activated its emergency recovery plan to help ensure payments to staff remain on schedule. For staff who may be impacted by any delays, we are committed to ensuring they ultimately receive the correct pay,” officials said on Thursday.
On Friday, the hospital was able to restore phone lines and the internal timekeeping system for staff payroll. Patients are still dealing with diagnostic and treatment delays due to the system outages.
No ransomware group has taken credit for the attack as of Tuesday morning.
Hospital for Sick Children is the latest children’s hospital attacked in recent years. FBI Director Christopher Wray said in June that Iranian government-backed hackers had targeted Boston Children’s Hospital, which he called “one of the most despicable cyberattacks I’ve ever seen.”
Ransomware attacks on healthcare organizations have continued throughout 2021 and 2022, including recent attacks on a hospital complex in France, a Texas hospital, a California nonprofit and the United Kingdom’s National Health Service.