Threat posed by mainland hacker forced GMH to shut down network | News

A hacker somewhere in the U.S. mainland got past the protective firewalls of Guam Memorial Hospital’s network and started exploring, which put all of the hospital’s interconnected computer systems at risk of cyberattack, according to the hospital’s legal counsel, who said the hospital provided information to federal investigators and is scheduled to meet with the FBI Wednesday.

The hospital, whose IT staff found evidence of an unauthorized network user on the evening of March 2, shut down all of its nearly 100 computerized systems — from phones to email — at 8 a.m. March 4 in order to increase security measures and prevent any damage or theft of information.

Hospital staff found evidence the unauthorized user had accessed the system “multiple times in the past.”

According to the hospital, there is no evidence that patient information, financial information or employee records were accessed, manipulated or destroyed.

There also were no demands for payment in connection with the incident, according to the hospital.

No disciplinary action was taken against any hospital employee in connection with the incident, according to GMH legal counsel.

The systems shutdown also affected the hospital’s satellite operations, at the skilled nursing facility in Barrigada Heights and at the prison clinic in Mangilao.

Hospital visitation was severely restricted for several days in order to allow employees to focus on restoring systems.

The hospital started operating manually during the shutdown, keeping records on paper, and as of Tuesday had restored about 75 percent of its computer systems. Some phone lines and email addresses, for non-critical employees and departments, still were not working as of Tuesday.

“The nature of the (unauthorized) access was identified, and an individual is identified as being the likely actor,” said hospital attorney Jeremiah Luther, who declined to provide further details about the security flaw or how the network was hacked.

Luther said the hospital will not publicly disclose the “likely actor’s” name in the interest of justice.

“We were told by our IT people that the threat to our system, to patient health…