Cyber attack at hospitals in NJ force emergency rooms to divert patients

The computer networks at two New Jersey hospitals were hit by a ransomware attack on Thanksgiving that impacted its sister hospitals around the country.

Pascack Valley Medical Center in Westwood and Mountainside Medical Center in Montclair, both members of the Hackensack Meridian Health System, have put protocols into place to handle the attack, according to spokeswoman Chiara Marababol.

The full impact of the attack is still under investigation by a third-party forensic advisor. The healthcare company took the network at both facilities offline cutting off all user access to its information technology applications, including corporate servers, software, internet and clinical programs.

No other Hackensack Meridian Health facilities are affected by the attack as they are on different networks.

"We continue to care for patients in both of our ERs, however, we have asked our local EMS systems to temporarily divert patients in need of emergency care to other area facilities while we address our system issues," Marababol said in a statement. "This ensures critically ill patients have immediate access to the highest level of care as we work to bring our systems back online."

Some elective procedures and non-emergency surgeries are being rescheduled.

Marababol said it is not yet known the extent of any patient health or financial data that may have been compromised by the cyber attack.

Impact of the security incident

Unnamed staff members at the hospitals told The Daily Voice the incident affected lab work, radiology, scheduling and billing forcing staff to use paper to make reports.

Some of the 37 hospitals owned by Ardent Health Services, the parent company of Hackensack Meridian Health, may have also been affected by the issue, according to a similar statement issued to KVII TV.

Ardent owns hospitals in Idaho, Kansas, New Mexico, Oklahoma and Texas.

Earlier breaches

Hackensack Meridian paid a ransom in 2019 to stop a cyberattack on 17 of its facilities. It did not disclose how much it paid.

A cyberattack at CentraState Medical Center in Freehold Township revealed that personal data of 617,000 patients on an archived database was stolen during a breach in December 2022. an "unauthorized person" obtained a copy of an archived database that stored patient information. No financial or payment information was kept in the archive.

CentraState did not disclose who was responsible for the theft or if any charges were filed.