HealthAlliance slow to acknowledge consequences of recent attacks 

With their computer systems crippled by a cyber attack last November, three Brooklyn hospitals (Brookdale, Interfaith and Kingsbrook Jewish) were taken offline as the result of a cyber attack. This August, similarly handicapped emergency departments at Manchester Memorial and Rockville General hospitals in Connecticut were forced to close down and divert patients to nearby medical centers. 

Last week, it was the turn of the local HealthAlliance facilities to be the target of a shakedown.

WMCHealth, parent company of HealthAlliance, hasn’t yet acknowledged whether those behind last week’s cyber attacks which paralyzed the hospital’s normal functioning are asking for money. The cyber attack at HealthAlliance took down the two other  HealthAlliance facilities as well, Margaretville Hospital and Mountainside Residential Care Center.

The level of sophistication of such cyber attacks typically comes with a price tag.

Spokespersons for the hospitals have not responded directly to questions put to them looking to know the name of the hackers, how much money they might have asked for, and the quantity and types of confidential patient records to which they have gained access. It is not yet publicly known how many HealthAlliance patients must be notified they have been affected by the computer-hacking operation. All information has so far been rationed out in curated packets.

In a press statement, HealthAlliance acknowledged that it was  “working with law-enforcement officials, including the FBI and a third-party cybersecurity firm, to determine the scope of the attack, and specifically what systems were impacted.”

The million-dollar question HealthAlliance must be asking is how many patients’ medical records were compromised during the course of the attack. Private information obtained could be sold on the dark web. 

The three facilities are owned by Westchester Medical Center Health Network, aka Westchester County Health Care Corporation, which is a state-level public benefit corporation, and as such is capable of raising considerable sums.

Targeting smaller affiliate hospitals related to larger hospital chains is a common strategy to gain access to bigger jackpots. Health Alliance’s relationship to parent company WMCHN may have made the hospital a plum target.

The 2023 annual state report on public authorities shows 2022 reported operating expenses of $1.804 billion for the health network.

An unauthorized interview with an unidentified employee

What is a matter of public record is that on Saturday October 14, the HealthAlliance hospital in Kingston became aware something was wrong. An interview with an unidentified employee of the hospital published by HV1 provides insight as to what was going on at the hospital from Saturday until Thursday. 

The first official statement from the hospital to acknowledge to the public that there was a problem was issued October 16. The statement referred to the situation as “a potential cybersecurity threat and an IT system outage.”

Oblique wording from the press release claimed that “patient care had not been impacted at this time.” 

The public was not told that since Saturday ambulances which would normally have been bringing those patients experiencing health-related emergencies or injuries were instead being diverted to other hospitals in the region.

Two days later, in a Thursday, October 19 press release, the hospital acknowledged to the public that ambulances were in fact being diverted to other nearby medical facilities. In this press release, WMCHealth also acknowledged for the first time that it was working with law-enforcement agencies.

On Friday, October 20, “to address the threat and take necessary steps to fully restore their secure network,” the three HealthAlliance facilities were “finally in a position where they could shut down the connected IT systems” without danger to patients.

By 7 p.m. Saturday, October 21, they were able to announce that they were now “fully operational and have resumed admitting patients.” 

In a suggestive coincidence of timing, the state gaming commission was hacked on October 17. It confirmed that its central operating system, which serves slot parlors throughout the state, was “impacted by a cybersecurity attack.” The Jake 58 casino in Suffolk County was closed for several days.

Gaming commission spokesman Brad Maione said the commission had no indication that personal identifiable information was compromised.

The Westchester Medical Center Health Network has yet to release a statement regarding the status of the personal identifiable information it has maintained.