NEW HAVEN, Conn. (WTNH)– Wednesday, Yale announced they had restarted treating cancer patients after a cyberattack took their radiation system offline nearly a week ago.
They say their third-party vendor – Elekta – was able to get some operations back online. They restarted treating patients Monday and have contacted them all individually to get their treatments back on track.
Yale New Haven Health has confirmed a cyber attack on one of its outside vendors has taken the entire health system’s radiation machines offline, cutting off some cancer care for 200 patients statewide.
News 8’s Sabina Kuriakose broke the story. Since Tuesday, doctors have been moving the most critically ill patients to other locations outside YNHH.
One family tells News 8 their loved one has late-stage breast cancer and hasn’t been receiving her radiation treatment for nearly one week. The family says the effectiveness of her treatment is dependent on the consistency and frequency of her radiation.
“My wife was on the verge of tears yesterday,” said the woman’s husband, “They were triaging patients to other health systems.”
“Everything we’ve been told, when you start treatment you’re supposed to go through the whole course of treatment,” he said, “You’re not supposed to skip any days.”
“The effectiveness of your treatment is diminished.”
Yale New Haven Health was forced to take its radiation machines offline following a series of cyberattacks on Elekta, the vendor that runs the machine software. 170 hospitals and healthcare systems nationwide have been affected by the breach. To prevent the malware from spreading, Elekta cut off access to its Cloud data storage.
“We do not have the ability to operate the machines because the information that is programmed into those machines is up in the cloud,” said YNHH CEO Marna Borgstrom.
Patients have seen their cancer treatment temporarily cut off or curbed.
Yale New Haven Health says it has been in touch with every patient, and doctors are managing individual care. The sickest cancer patients have been sent to other health systems. The family News 8 spoke with says their loved one was initially asked to go to Griffin Hospital for treatment.
News 8 asked YNHH officials how the breach was affecting their standard of care.
“Anytime a patient has any delay in care, we share in their concern as well and we understand their concern,” said YNHH spokesman Vin Petrini. “We have tried to find alternative treatments for them in the meantime.”
“It’s extremely stressful. It’s extremely stressful and it’s stress we can do without,” said the patient’s husband.
YNHH officials tell News 8 that right now, they don’t believe patients’ personal information has been hacked.
In response to our reporter’s questions, Elekta tells News 8:
“Elekta was subjected to a series of cyberattacks which affected a subset of U.S-based customers on our first-generation cloud system. On April 20, to contain and mitigate the attacks, Elekta proactively took down its first-generation cloud system in the United States.”
As for whether any private health information was leaked during the breach, Elekta says:
“An investigation is being conducted, and any affected customer(s) will be contacted and fully briefed through the appropriate channels and in accordance with any legal requirements.”
YNHH says it plans a thorough review of the incident.
The system was expected back online by Monday. But now Elekta says they are not sure what the timeline will be and does not want to make an estimation.
In a statement to News 8 Monday, a spokesperson said, in part, “We are working on getting everyone fully operational and we are putting all possible effort and resources into this…We are working to get everyone back online and into our new cloud system. We truly understand the frustration but we need to ensure that this is done in a secure way for our customers.”
Monday we spoke with a cancer patient whose radiation treatments have been impacted by the breach.
He explained, “I had a routine. Every day I get in the car, drive 20 minutes over to Waterford and get my treatment five days a week, Monday through Friday.”
Diagnosed with prostate cancer last October, he’s been receiving treatments since mid-March. Since this shutdown, he’s missed four treatments.
“Friday my actual radiologist I talk with every Friday called me to say ‘this is a cyber attack, not just a software problem; it was deliberate.'”
Thankfully, his cancer is contained, but some other patients aren’t so lucky and rely on these daily treatments.
“It’s appalling to me that someone would do this to people who are sick.”
