Group Claims Credit For Ransomware Attack On Hillcrest Healthcare System

Hillcrest Medical Center said it continues to recover from a cyber attack, with most patient services restored.

News on 6 has learned a group called “BlackSuit” claimed credit for the attack in a ransom note that appeared on screens at the hospital.

The government issued a warning to hospitals on November 6 that the group was targeting hospital systems and had already disrupted work in an imaging network affecting 1,000 hospitals.

The ransomware at Hillcrest could have come from anywhere in the world, according to TU Cyber Studies professor Tyler Moore.

“We have a global internet, and they can be operating on the other side of the world and have an effect here in Tulsa,” said Professor Moore.

The ransom note said an "Extortioner named BlackSuit has attacked your system," said all of the files were encrypted and could be leaked, and told users to contact the hacker through the dark web to arrange the payment.

Professor Moore read the ransom note and said it was typical.

“Essentially, what makes a hospital such a problematic target for hospitals is that you need these systems to be operational," he said. "It's sometimes a matter of life or death, right?”

Hillcrest is accepting patients as it was before the attack, but to get an appointment, patients need to call instead of trying to do that online. The emergency department is again taking patients as usual.