Ransomware attack took Lurie Children's Hospital systems offline for weeks

Ann & Robert H. Lurie Children's Hospital of Chicago took its network offline on January 31, 2024 after detecting an intrusion. Phone and email systems, the electronic health record and the MyChart patient portal all went down, and the hospital blocked external internet traffic.

The pediatric hospital, which treats about 239,000 children a year, stayed open and switched to paper-based downtime procedures. Some appointments and elective surgeries were canceled, and patients faced longer waits between requesting a prescription and receiving it. On February 8 the hospital confirmed it had been targeted by what it described as a known criminal threat actor, and said it was working with internal and external specialists and with the FBI.

Later in February the Rhysida ransomware group listed Lurie Children's on its leak site, claiming to hold 600GB of stolen data and offering it for 60 bitcoin, about $3.4 million at the time. Rhysida, a ransomware-as-a-service operation active since mid-2023, had already prompted a US Department of Health and Human Services warning about its attacks on healthcare providers.

Restoration ran for weeks. The MyChart portal was still offline as of February 22, according to The Record, and clinical staff continued working from manual records. The hospital said throughout that it remained open and was providing care with as few disruptions as possible while recovery continued.