Patients are still unable to access University Hospitals websites and MyChart two weeks after a cybersecurity incident.
A statement this week from the hospital system said it does not have an estimated timeline for when systems will be fully restored. The statement goes on to address a high number of calls from patients concerned about the incident, and encourages people to contact their doctors’ offices directly with questions.
The hospital system first noticed “unusual activity” on its servers on Oct. 22 and disconnected systems from the internet “out of an abundance of caution.”
A study looking at ransomware attacks on U.S
A study looking at ransomware attacks on U.S. hospitals and health care providers found it takes on average 16 and a half days to recover from such cyberattacks, said Cory Scott, Executive Director of the Cybersecurity Center at Cleveland State University’s College of Law.
“This is not, unfortunately, an unusual amount of time yet,” Scott said.
University Hospitals has not responded to questions regarding the type of attack they detected, but a spokesperson confirmed the hospital’s intranet, which allows doctors to access patient records, is fully operational.
The hospital system has been encouraging patients to keep their in-person appointments. Virtual visits are being moved to phone, Zoom or in-person appointments.
Scott said that with these types of security incidents, hospitals have to proceed methodically.
People are incredibly cautious when they see
“People are incredibly cautious when they see the first sign of … potential unauthorized access to data or that a perimeter has been breached by a cyber adversary,” he said. “So you go into this lockdown mode, where you try to at first contain the damage and not have it get worse.”
In such instances, hospital systems have to investigate theo eradicate the attacker, rebuild any compromised systems and still maintain a level of care for patients. All of that can take time, he said
“You’re trying to make sure that you can provide a core set of services such as labs, imaging, scheduling those things that keep patients coming in and getting the care that they need in a degraded form, while also running a security investigation and making sure that the systems that you rely on are not in control of an adversary,” he said.
Complicating recovery time is the sheer volume
Complicating recovery time is the sheer volume of attacks on health care facilities. According to the cybersecurity research firm Comparitech, “ransomware attacks on the healthcare sector reached a new high with an average of 3.33 attacks per day” in the third quarter of 2026.
University Hospitals is working with external investigators to help address the cybersecurity incident, but Scott said many such firms are busy and stretched thin.
“The reality is, is that when these systems are strained, the delay in recovery will be greater,” he said.
Internally, University Hospitals providers have not been given
Internally, University Hospitals providers have not been given significantly more information than the general public. A set of internal e-mails reviewed by Ideastream Public Media thanks providers for continuing to provide care, and instructs them to reset their passwords, but does not give any specific updates regarding the type of cyberattack the hospital experienced or a timeline of when the hospital system is expected to return to functioning normally.
“We cannot repeat it enough. Thank you to each and every one of you who have adjusted your routines and workflows to continue to serve our patients,” states one such e-mail from UH CEO Cliff Megerian.
Scott said vague internal communications are standard protocol in such instances, as attackers will often monitor hospitals’ public statements.
By keeping that information very close
“By keeping that information very close to the to the chest it makes sure that they keep the attackers in the dark as well,” he said.
And hospital officials may be reluctant to give any specific dates for restoration of systems in case they cannot meet those dates and risk losing further trust from the public and providers, Scott said.
Providers have taken to calling in prescriptions by phone or writing receipts by hand while systems are down. Patients have been receiving phone calls with laboratory results and getting phone call reminders of upcoming appointments rather than relying on their MyChart accounts. Several apps used by UH providers cannot be accessed, or can only be accessed
The hospital system is facing a proposed class-action
The hospital system is facing a proposed class-action lawsuit alleging that personal information was compromised during the cybersecurity incident and did not implement reasonable “cybersecurity safeguards or policies to protect patients’ sensitive information.”
University Hospital has not commented on whether any personal information was accessed during the cybersecurity incident.
Hospital systems have 60 days to report data breaches that put personal health information at risk to the Department of Health and Human Services. University Hospitals has not yet made any such disclosures.
Note: This story has been updated to correct a misspelling of Cory Scott’s name. We apologize for the error.
