Two law enforcement sources, who spoke with the Maine Wire on the condition of anonymity as they were not authorized to speak publicly about the incident, believe that multiple large institutions in Maine suffered from a ransomware-style cyberattack thought to originate from a foreign adversary.
Multiple hospitals across the state appear to be suffering from technical issues, possibly caused by a cyberattack. As of Wednesday afternoon, the Central Maine Medical Center’s (CMMC) entire website is inaccessible.
St. Joseph Healthcare and St. Mary’s Health System both currently display banners on their respective websites addressing a “temporary system issue that may affect phones and internet access.”
Both hospitals are operated by Covenant Health, which faced a cyberattack in May that also impacted St. Joseph’s Hospital in New Hampshire.
The Maine Wire reached out to St. Joseph Healthcare and St. Mary’s Health System, requesting more information, including details on the origin of the attack, any demands made by hackers, and whether any patient information had been compromised.
Covenant Health’s Chief Communications Officer, Karen Sullivan, responded to The Maine Wire’s inquiry and spoke about the May cyberattack.
Sullivan confirmed that the organization first became aware of a cyberattack on May 26 from an outside organization. They have not finished their investigation and did not say whether they have any information on the attackers.
“On Monday, May 26, Covenant Health became aware of irregularities impacting connectivity across the organization. Out of an abundance of caution, we immediately discontinued access to all data systems in our hospitals, clinics and provider practices. Upon further investigation, we discovered these irregularities were the result of a cyber incident initiated by an outside group,” she said.
She said that their systems will be fully restored as soon as possible but did not provide a timeline. Notably, she did not answer The Maine Wire’s questions about the demands made by the attackers and did not say whether patient information was compromised.
On Monday, Michael McClain of Bangor filed a class action lawsuit against Covenant Health, and alleged that St. Joseph Healthcare and Covenant Health failed to secure patient data in the face of May’s cyberattack.
The Maine Wire received information suggesting that the Lewiston Police Department had also come under the ransomware cyberattack, but Lewiston Police Public Information Officer Derrick St. Laurent denied that their department had been involved.
He did, however, confirm that multiple local hospitals faced recent cyberattacks.
“We are aware of the recent cyberattacks targeting several local hospitals. However, we would like to clarify that the City of Lewiston was not affected by these incidents. We did experience a brief outage last week, but it was the result of a planned disconnection, and services were fully restored within minutes,” he told The Maine Wire.
The Northern Light Hospital System also responded to an email from The Maine Wire, asking if they had been affected. They claimed that they have been unaffected by the ongoing data breaches across the state.
“I have checked in with our IS (sic) Security team and verified there is no validity to this claim. We remain unaffected by any of the data security incidents currently occurring throughout Maine,” they said.
