Cyber Incident Victim: The Pediatric Physicians Organization at Childrens
Date:
Feb 2020
Location:
United States of America
Summary
A malware attack disrupted medical record systems at a pediatric physicians' organization affiliated with a major children's hospital, impacting over 500 primary care providers across its network. The incident exclusively affected offices connected to the organization's distinct IT infrastructure, which was quarantined to prevent further spread, while the hospital itself remained operational. Service interruptions led some clinics to recommend rescheduling routine appointments and delaying non-urgent visits for minor symptoms, though officials confirmed the containment halted additional damage.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around February 11, 2020, the Pediatric Physicians’ Organization at Children’s (PPOC), a network affiliated with Boston Children’s Hospital, experienced a malware attack that disabled its medical records system. The incident caused a widespread outage impacting more than 500 primary care providers, including physicians, nurse practitioners, and physician assistants across Massachusetts. The compromised network was distinct from Boston Children’s Hospital’s own systems, which remained unaffected. PPOC’s IT team responded by quarantining the infected systems to prevent further spread of the malware. A spokesperson confirmed the containment measures were effective, stating there would be no additional impact beyond the initial disruption. The attack occurred during normal operations, though the exact timing and method of malware intrusion were not publicly disclosed.
The outage significantly disrupted clinical operations at PPOC-affiliated offices, forcing some practices to adjust patient care schedules. Multiple offices advised families to postpone routine checkups scheduled for Wednesday, February 12, and recommended that children with mild symptoms delay non-urgent visits. This guidance aimed to reduce patient volume while systems remained offline, though the duration of the outage was not specified. No data theft or unauthorized access to patient records was mentioned in initial reports. The incident exclusively affected PPOC’s network infrastructure, with no spillover to Boston Children’s Hospital’s clinical or administrative systems. Restoration efforts and forensic investigations were not detailed in available disclosures.