Two weeks after a cybersecurity incident, University Hospitals says it does not have an estimated timeline for when its websites and MyChart will be restored. Patients remain unable to access those online services, and the hospital system is urging people to contact their doctors’ offices directly with questions.
The system first detected “unusual activity” on its servers on Oct. 22 and disconnected systems from the internet “out of an abundance of caution,” the hospital said. A spokesperson confirmed the hospital’s intranet, which allows clinicians to access patient records, is fully operational, but University Hospitals has not answered questions about the type of attack it detected.
University Hospitals investigation and patient services
University Hospitals has been moving virtual visits to phone, Zoom or in-person appointments and encouraging patients to keep in-person appointments. Providers have been calling in prescriptions by phone, writing receipts by hand, relaying lab results by phone and using phone reminders instead of MyChart notifications. Several apps used by UH providers cannot be accessed or are only accessible via desktop computers.
Internally, providers have received limited information. A set of internal e-mails reviewed by Ideastream Public Media thanked staff for continuing care, instructed them to reset passwords and did not provide details on the type of attack or a timeline for a full return to normal operations. “We cannot repeat it enough. Thank you to each and every one of you who have adjusted your routines and workflows to continue to serve our patients,” states one such e-mail from UH CEO Cliff Megerian.
Cory Scott, Executive Director of the Cybersecurity Center at Cleveland State University’s College of Law, said recovering hospital systems from ransomware-style attacks commonly takes time. He noted a study that found it takes on average 16 and a half days to recover from such cyberattacks and added, “This is not, unfortunately, an unusual amount of time yet.”
Scott described the typical response: “People are incredibly cautious when they see the first sign of … potential unauthorized access to data or that a perimeter has been breached by a cyber adversary,” he said. “So you go into this lockdown mode, where you try to at first contain the damage and not have it get worse.” He added that hospitals must investigate the breach, assess damage, eradicate attackers, rebuild compromised systems and maintain core services in a degraded form: “You’re trying to make sure that you can provide a core set of services such as labs, imaging, scheduling those things that keep patients coming in and getting the care that they need in a degraded form, while also running a security investigation and making sure that the systems that you rely on are not in control of an adversary,” he said.
Scott also warned that outside investigators are in high demand. “The reality is, is that when these systems are strained, the delay in recovery will be greater,” he said. He noted that vague internal communications are common because “By keeping that information very close to the to the chest it makes sure that they keep the attackers in the dark as well,” he said.
Complicating the sector’s recovery efforts is the volume of attacks on health care. According to cybersecurity research firm Comparitech, “ransomware attacks on the healthcare sector reached a new high with an average of 3.33 attacks per day” in the third quarter of 2026.
University Hospitals is working with external investigators to address the incident. The health system is also facing a proposed class-action lawsuit alleging that personal information was compromised during the cybersecurity incident and that the system “did not implement reasonable cybersecurity safeguards or policies to protect patients’ sensitive information.” University Hospitals has not commented on whether any personal information was accessed, and it has not made any disclosures to the Department of Health and Human Services; hospital systems have 60 days to report breaches that put personal health information at risk.
Note: This story was updated to correct a misspelling of Cory Scott’s name.
