Universal Health Services Ransomware Attack Cost $67 Million in 2020


The past 12 months were very year for ransomware attacks on the healthcare sector. One of the worst of these was suffered by the King of Prussia, PA-based Fortune 500 healthcare system, Universal Health Services (UHS).

UHS, which manages 400 hospitals and behavioral health clinics in the United States and United Kingdom, was impacted by such a cyberattack in September 2020 that deleted all of its IT databases, impacted its hospitals and other healthcare centers around the country.

As part of the attack , the phone system was no longer operational and there was no access to computers and electronic health records, staff had to use pen and paper to take down patient data. In the early hours after the attack took place, the health system moved ambulances to alternative facilities and a portion of elective procedures were either cancelled or moved to competitors. Patients reported delays receiving test results while UHS moved to address the impact of the attack.

UHS moved quickly to bring its information technology infrastructure back online in the aftermath of the attack and worked around the clock to restore normal business operations; however, the recovery process last approximately three weeks. The disruption naturally had a major impact on financial outlook of the group, with the UHS quarterly earnings report for Q4, 2020 showing $42.1 million in losses, which equated to 49 cents per diluted share. UHS ended the quarter with profits of $308.7 million, up 6.6% from Q4, 2019.

Bring the IT infrastructure back online lead to a major rise in labor costs, both internally and externally. Cash flows were also impacted as certain administrative functions such as coding and billing had to be moved to December 2020.

UHS has reported total pre-tax losses of an approximate $67m in 2020 due to the ransomware attack, mostly due to the loss of operating income, crop in patient activity, and greater revenue reserves as a result of the billing delays. UHS is of the belief that it is entitled to recover the majority of the $67 million in insurance payouts.