WMCHealth diverted ambulances after a cyberattack on Hudson Valley hospitals

Westchester Medical Center Health Network confirmed on October 21, 2023 that a cyberattack had struck its HealthAlliance of the Hudson Valley division in New York. Three facilities were affected: HealthAlliance Hospital in Kingston, Margaretville Hospital, and Mountainside Residential Care Center in Margaretville.

The network first warned publicly on October 16 that it was dealing with a potential cybersecurity threat and an IT system outage. At 10 p.m. on Friday, October 20 it shut down all connected IT systems at the three sites, expecting roughly a day of downtime while systems were brought back on a rolling basis. With clinical systems unavailable, ambulances were diverted to other hospitals and some admitted patients were transferred or discharged.

The diversion ended on the evening of Saturday, October 21 and the facilities resumed admitting patients, though stroke cases continued to be routed elsewhere for a period. WMCHealth said it had notified the New York State Department of Health and officials in Ulster and Delaware counties, was working with law enforcement including the FBI, and had engaged an outside cybersecurity firm.

A later review, disclosed in December 2023, established that intruders had been inside the network from August 18 to October 13, 2023 and had taken patient names, addresses, dates of birth, Social Security numbers, diagnoses, lab results, medications, treatment details, insurance information and financial data. HealthAlliance began mailing notification letters and offered credit monitoring and identity theft protection. Local residents criticised the network for how little it explained while the outage was under way.