Cyber Incident Victim: Michigan Medicine
Date:
Jan 2023
Location:
United States of America
Summary
Michigan Health experienced intermittent disruptions to its public websites due to a cyber attack targeting a third-party hosting vendor. The organization confirmed no patient information was compromised, as the affected external sites did not contain such data, and emphasized that all patient records remained secure. While mitigation efforts were ongoing with the vendor, access to critical services like the patient portal remained unaffected and operational throughout the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 30, 2023, University of Michigan Health publicly disclosed intermittent disruptions affecting its public websites due to a cyber attack targeting a third-party hosting vendor. The health system confirmed the operational issues originated from an external compromise of infrastructure managed by this vendor, which supported a subset of Michigan Medicine's public-facing web assets. Officials emphasized that core patient care systems and the myuofmhealth.org patient portal remained fully operational throughout the incident, enabling uninterrupted access to medical records and clinical services. The organization initiated coordinated mitigation efforts with the affected vendor to restore website functionality, though no specific timeline for full resolution was provided in their initial statement. Internal systems handling electronic health records, appointment scheduling, and other critical healthcare operations were confirmed to operate independently from the compromised vendor environment.
Michigan Medicine clarified that the cyber attack exclusively impacted public websites hosted externally by the third party, explicitly excluding any infrastructure containing protected health information or patient data. No evidence suggested unauthorized access to clinical databases, financial systems, or personally identifiable information maintained by the health system. Continuous monitoring confirmed the segregation between the breached vendor systems and Michigan Medicine's internal networks housing sensitive data. The organization maintained public communications through alternative channels while restoration efforts continued, reiterating that patient care delivery and safety protocols were unaffected. Technical teams collaborated with the vendor to implement security measures preventing further disruption, with full website functionality expected following completion of forensic reviews and system hardening procedures.