A cybersecurity incident at Brockton Hospital has forced staff to revert to paper records and analog methods as officials Wednesday continued work to restore systems and investigate the breach.
Signature Healthcare, the hospital’s parent company, said the issue began Monday after “suspicious activity” was detected on part of its network, prompting officials to shut down the hospitals’ systems and activate emergency protocols.
“Our systems are offline,” Brooke Hynes, a spokesperson for the hospital, said in an interview Tuesday.
The hospital is working with outside cybersecurity experts and has notified State Police and the FBI, Hynes said.
Kirsten Setera, an FBI spokesperson, confirmed the office is “aware of the incident” involving Brockton Hospital but declined to comment further. State Police spokesperson Tim McGuirk said Signature reported the activity to the Commonwealth Fusion Center but said he could not release further details.
“As we urge the public to report suspicious activity they observe, we also encourage businesses to share information in this way,” McGuirk said in an email. “Doing so allows public and private partners to continually strengthen our approach to cyber security.”
Officials have not yet determined the nature of the incident, including whether it involves ransomware or if any patient data was accessed or compromised.
“We don’t have any immediate indication that anything has been [accessed], but we don’t know,” Hynes said. “That will be part of the full investigation.”
There is no estimated timeline for when systems will be restored, a detail that forensic cybersecurity experts say can signal how complex the situation may be.
Kyle Sandy, director of cybersecurity at Logically, said the hospital’s decision to take systems offline is consistent with either a precautionary shutdown or a potential ransomware attack.
“They thought maybe there is something here, and maybe it gets worse if we don’t take these services down,” Sandy said in an interview Tuesday.
The incident at Brockton Hospital comes after a cyberattack tied to the war in Iran was launched against the US medical equipment company Stryker in March, which led Mass General Brigham officials to alert employees not to log into Stryker accounts or portals.
With electronic systems unavailable, clinicians at Brockton Hospital have shifted to “downtime” procedures, relying on handwritten medical records, paper orders, and faxed communication in place of digital methods.
“Downtime means when things are offline, when you can’t use the electronic health record,” Hynes said. “It’s basically moving to paper-based systems ... things are done manually, as opposed to sending them electronically.”
Hospital operations remain partially intact. Inpatient care and walk-in emergency services are still available, though ambulance traffic is being diverted to other facilities in the region, including South Shore Hospital and Boston Medical Center South.
A spokesperson for BMC South said the hospital has increased staff to ensure continuity of care. A South Shore Health spokesperson said the hospital has received “some patients” from Brockton Hospital and has activated “internal surge plans” to meet patients’ needs.
The diversion is intended to prevent overcrowding in the emergency department, Hynes said, noting that walk-in patients can still be treated at Brockton Hospital.
The scenes inside Brockton Hospital this week have resembled moments from the current season of “The Pitt," a popular medical drama on HBO Max, where doctors and nurses were forced to abandon their digital systems and fall back on analog tools to keep care moving. In the show, whiteboards stand in for electronic patient tracking systems and paper charts replace health records.
Hynes said the situation in Brockton is similar to what viewers have seen on the TV show, minus the actors, of course.
“I haven’t seen Noah Wyle walking around, much to my disappointment,” Hynes joked, referring to the show’s lead star. “Yes, it is similar to ‘The Pitt’ where they bring out the whiteboards and they create folders and paper medical records and they may fax an order for a prescription or a lab result.”
Surgeries and procedures, including endoscopy, are continuing as scheduled, the hospital said in an alert on its website, but some services have been disrupted.
Chemotherapy infusions were canceled Tuesday, though hospital officials said later in the day that treatments were beginning to resume, with care teams working directly with patients to coordinate plans. On Wednesday, the hospital said chemo infusion services had resumed for all new patients and existing patients were being phased back in.
Urgent care practices are open, though patients may experience delays, officials said. The hospital’s retail pharmacies in Brockton and East Bridgewater were open for consultation but unable to fill new prescriptions Tuesday, and requests for copies of medical records are temporarily unavailable.
“Everything takes a little bit longer because it’s all manual,” Hynes said.
Inside the hospital, staff have turned to low-tech tools to track patients and manage care, including large boards that replace electronic bed-tracking systems.
Despite the disruption, Hynes said staffing levels remain normal and employees are trained to operate under downtime conditions.
“We have protocols around how each unit will move to an offline day,” she said. “Everybody has the tools they need and the support they need.”
In a statement Tuesday evening, Signature Healthcare said patient care was continuing safely across its sites, even as many of its sytems remained offline.
“We are working closely with third-party cybersecurity experts, as well as state and federal officials, to determine the source of this incident,” Kim Walsh, Signature Healthcare’s chief operating officer, said in the statement. “Our care teams continue to provide high-quality care using established downtime procedures.”
Cybersecurity experts say recovery timelines in cases like this can vary depending on how prepared an organization is.
“If you’ve got good backups and you’ve got a plan ... you can quickly restore,” Sandy said. “If you don’t ... you might have to rebuild systems that have been in place for years. It could take months until you’re fully operational again.”
More broadly, experts say cyberattacks on hospitals can have ripple effects across entire regions.
“Any cyberattack on the health care sector that disrupts or delays patient care creates a risk not only to patient safety, but also creates a risk to the safety of the entire community that depends on the availability of their nearest hospital,” said John Riggi, the American Hospital Association’s national adviser for cybersecurity and risk.
Riggi said such incidents can lead to ambulance diversions, delayed treatments, and increased strain on nearby hospitals, a dynamic he described as a “ransomware blast radius.”
The Massachusetts Nurses Association said nurses at Brockton Hospital have adapted to the situation with no reported negative consequences so far. But the union raised concerns about the ripple effects of ambulance diversions, particularly at Boston Medical Center South, which has been receiving additional emergency cases.
The cybersecurity issue at Brockton Hospital comes as the hospital continues to recover from past disruptions, including a 2023 fire that previously closed the facility.
Brockton Hospital officials said their focus is on maintaining patients safety while their systems are restored.
“The teams here have been amazing [and are] well trained to move into these protocols,” Hynes said.
In 2024, the Change Healthcare cyberattack disrupted prescriptions, lab reports, and billing in New Hampshire. The global CrowdStrike outage later that year pushed hospitals and EMS crews in the Boston area into manual operations.
In 2022, Christopher Wray, then the director of the FBI, revealed that hackers linked to the Iranian government had attempted to breach Boston Children’s Hospital the year before, though authorities said the attack was stopped before it caused damage.
Jeremiah Manion of the Globe staff contributed to this report.
Nick Stoico can be reached at nick.stoico@globe.com.