[BreachExchange] Universal Health Services Ransomware Attack Cost $67 Million in 2020

[Destry Winant]

https://www.hipaajournal.com/universal-health-services-ransomware-attack-cost-67-million-in-2020/#:~:text=Universal%20Health%20Services%20Ransomware%20Attack%20Cost%20%2467%20Million%20in%202020,-Home%20HIPAA%20Breach&text=The%20disruption%20naturally%20had%20a,49%20cents%20per%20diluted%20share.

2020 was a particularly bad year for healthcare industry ransomware
attacks, with one of the worst suffered by the King of Prussia,
PA-based Fortune 500 healthcare system, Universal Health Services
(UHS).

UHS, which operates 400 hospitals and behavioral health facilities in
the United States and United Kingdom, suffered a cyberattack in
September 2020 that wiped out all of its IT systems, affecting its
hospitals and other healthcare facilities across the country.

The phone system was taken out of action, and without access to
computers and electronic health records, employees had to resort to
pen and paper to record patient information. In the early hours after
the attack occurred, the health system diverted ambulances to
alternative facilities and some elective procedures were either
postponed or diverted to competitors. Patients reported delays
receiving test results while UHS recovered from the attack.

UHS worked fast to restore its information technology infrastructure
following the attack and worked around the clock to return to normal
business operations; however, the recovery process took around 3
weeks. The disruption naturally had a major impact financially, with
the UHS quarterly earnings report for Q4, 2020 showing $42.1 million
in losses, which equated to 49 cents per diluted share. UHS ended the
quarter with profits of $308.7 million, up 6.6% from Q4, 2019.

Restoring its IT infrastructure resulted in significant increase in
labor costs, both internally and externally. Cash flows were also
affected as certain administrative functions such as coding and
billing had to be delayed until December 2020.

UHS has reported total pre-tax losses of an estimated $67 million in
2020 due to the ransomware attack, mostly as a result of the loss of
operating income, reduction in patient activity, and increased revenue
reserves as a result of the billing delays. UHS believes it is
entitled to recover the majority of the $67 million in insurance
payouts.