Cyber Incident Victim: Anna Jaques Hospital
Date:
Dec 2023
Location:
United States of America
Summary
A cyberattack compromised the hospital's computer systems, including electronic health records and networked functions, prompting an immediate shutdown and engagement of cybersecurity professionals. The incident caused significant operational disruptions, including ambulance diversions to nearby hospitals, service delays, and ongoing recovery efforts. Staff utilized manual processes for patient care while the union representing nurses raised clinical concerns about inadequate communication from administration regarding care protocols and staffing. The union also formally alerted health authorities about the unresolved system outages and potential risks to patient safety.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 24, 2023, Anna Jaques Hospital experienced a cyberattack that compromised its computer systems, forcing the shutdown of all networked functions including electronic health records. The hospital detected the intrusion and immediately secured its environment, engaging external cybersecurity professionals to investigate the incident. By Christmas Day, the hospital diverted ambulance arrivals away from its emergency department to nearby facilities including Exeter Hospital and Beverly Hospital within the Beth Israel-Lahey Health system, citing patient safety concerns. Newburyport Mayor Sean Reardon was notified of the electronic health record system outage on December 25. Ambulance diversions continued until the afternoon of December 26, when the hospital resumed accepting emergency patients via ambulance transport. Hospital administrators confirmed the incident as a cyberattack but declined to specify whether it was targeted or provide details about the attackers' methods.
The system-wide network outage persisted through at least December 28, with recovery efforts ongoing and no estimated restoration timeline provided to staff. Clinical operations faced significant disruptions, with nurses reporting reliance on manual processes for patient care documentation. The Massachusetts Nurses Association union submitted urgent questions to hospital administration regarding patient information handling and staffing adequacy during the crisis, but received no substantive response by December 28. The union escalated concerns to the Massachusetts Department of Public Health's Bureau of Health Care Safety and Quality, documenting the complete network shutdown and lack of restoration prognosis. Patient service delays continued throughout the incident period, though hospital leadership maintained that clinical care standards were preserved. The cyberattack occurred during ongoing labor tensions, with nurses' union contracts set to expire December 31, 2023, following months of disputes over working conditions.