A Brooklyn Hospital Network Battles a Cyberattack

For nearly two months, One Brooklyn Health, a group of hospitals that serves patients in some of New York City’s poorest neighborhoods, has been battling the consequences of a cyberattack that forced some critical services temporarily offline.

Today, even as cybersecurity experts work to get the hospitals fully back online, doctors and nurses are still forced to rely on methods most hospitals left behind in the 1990s: pen-and-paper patient care.

LaRay Brown, the chief executive officer of One Brooklyn Health — which includes three Brooklyn hospitals, Interfaith Medical Center, Brookdale Hospital Medical Center and Kingsbrook Jewish Medical Center — confirmed the attack, which was first detected in late November. She said that the hospitals were working with security experts to remediate the problems, which at one pointshut down all-important hospital work stations through which health care providers access medical records, order prescriptions and fill in patient charts.

“One Brooklyn Health has made considerable progress in our investigation and remediation process in response to a cybersecurity incident we detected in late November,” Ms. Brown said in an emailed statement over the weekend. “In the meantime, all of our hospitals and facilities are open, and we continue to provide care for our patients using well-established downtime procedures for which our clinicians and administrators are extensively trained.”

Whether this was a ransomware attack, in which the hackers demand payment, has not been publicly disclosed. The FBI declined to comment on the case, citing policy. Other public safety agencies did not immediately respond to requests for comment.

The cyberattack was reported earlier by The City.

Scheena Iyande Tannis, a critical care nurse at Brookdale for the past 17 years, said that the electronic medical system had been down for the past several weeks, pushing her to turn to methods she first learned in the days before the hospital had electronic medical records.

“My day-to-day has changed a little bit, just re-familiarizing yourself with the paperwork that is needed, but the actual care of the patient remains the same, because patients present, disease processes present, as they always have,” Ms. Tannis said. “And I’m an experienced nurse that grew up in critical care using the paper charting.”

In an interview, a hospital employee who works in inpatient psychiatry at Interfaith said that the cyberattack required his unit to create new workarounds: Hard-copy patient records now must be carried by hand to the unit. He said that the ability to provide care had not changed, but noted that lab results now took longer. The hospital employee requested anonymity because he was not authorized to speak about the hack.

Brookdale is located in Brownsville, a predominantly Black neighborhood in Brooklyn where the poverty rate is twice the citywide rate. The neighborhood’s skyline is dominated by public housing towers including the Woodson Houses, Tilden Houses and Seth Low Houses.

Brookdale and other such safety-net hospitals were quickly overwhelmed during the deadly first wave of the coronavirus pandemic in the spring of 2020. Patients in the surrounding neighborhood have a higher incidence of chronic health conditions, including obesity and hypertension, both of which made Covid-19 more deadly. The hospitals were also understaffed.

Approximately 2,500 Covid-19 patients were admitted by One Brooklyn Health hospitals in the spring and summer of 2020. One-third, or 831 of them, died, the system said.

Ms. Tannis, the critical care nurse, cited that experience as girding her for the inconveniences of the cyberattack. “I made it through many a battle,” she said. “This is more like a hiccup rather than a battle.”

Since 2017, there have been more than 3,600 local, tribal and state governments across the country targeted by ransomware hackers, according to the Multi-State Information Sharing and Analysis Center, an organization that seeks to enhance the cybersecurity posture of the United States. Hospitals are increasingly a favorite target of hackers. In April, the U.S. Department of Health and Human Services issued a warning to health care providers that a particularly aggressive hacking gang was targeting them.

The hospital’s leadership said that workarounds are in place that have allowed operations to continue relatively smoothly, and after taking the hospital’s network offline in an effort to contain the intrusion, many services have been restored.

One Brooklyn Health grew out of a longstanding state effort to consolidate struggling hospitals in Central Brooklyn. Brookdale is the largest of the hospitals, although Interfaith is one of the largest providers of inpatient psychiatry in Brooklyn, with more than 120 beds allocated for behavioral health.