Clinics around the state remain closed, though hospitals and emergency departments in Jackson and Grenada, as well as in Madison and Holmes counties, are open. As of Wednesday, regularly scheduled clinic appointments and elective procedures are cancelled through Friday.
"UMMC is making significant progress in its response to the cyberattack and restoring systems," the center wrote in a statement on Wednesday. "Through diligent, around-the-clock work, UMMC is hopeful that it will be able to resume normal clinic operations as soon as Monday. Additional information will be released about the timeline for restarting clinic and elective surgery operations in the coming days."
Time will likely be the biggest factor for the center's recovery, as it has been for other hospitals hit with similar attacks.
"In other attacks, recovery has taken multiple weeks, not days," said Cynthia Kaiser, former deputy director of the FBI's Cyber Division.
She's also the current senior vice president at the ransomware research center of Halcyon, an anti-ransomware solution provider. She said that delays can negatively impact patient outcomes.
"All these delays, all these having to go to a different place or be on paper records and having delays there, it harms patient outcomes," Kaiser said. "And the result is, as a University of Minnesota study showed, that at least 47 deaths occurred in the US between 2016 and 2021 because there are ransomware attacks on hospitals."
Kaiser noted that some of these studies looked only at Medicare deaths, which she called a "small subset". But, one of those studies from the University of Minnesota found that ransomware attacks were unique in how they could contribute to negative outcomes, including increased in-hospital mortality for patients already admitted.
But, Kaiser said opening too soon could easily lead to another ransomware attack.
"Often you see systems come up too soon and then the ways in which the bad guys have actually gotten onto a system, they aren't fixed and they can come back again," she said. "Or, you can see some other ransomware groups coming back again."
This isn't the first time that UMMC has suffered a breach. In 2013, information from about 10,000 patients was exposed and an investigation found that UMMC had been aware of vulnerabilities as far back as 2005.
Kaiser said that proactivity is crucial to prevent these kinds of attacks, but also highlighted some of the challenges in that.
"It's always going to be this arms race with the attackers," she said. "You put up your wall and then the attackers figure out how to get around, over the wall."
And, with often scant funding, she said hospitals need support from state and federal governments — in dollars, but also in other ways.
"States can really provide additional assistance to at-risk organizations like hospitals, through being able to provide more of the information, sharing the threat intelligence, the access to understanding who's a good vendor," she said.
Kaiser says a foundational plan includes three main pillars.
"First is, do we have the basic service security hygiene steps in place?" she said. "Do you have complex passwords? Do you have a process to automatically update software?"
If attackers do breach defenses, the second pillar is having multiple layers: something she highlighted as being a realistic priority in a system that may never be able to fully prevent attacks.
"Have we separated access to functions like pharmacy, billing, labs? So if an attacker gets into one of those: they only got into one those," Kaiser said. "Do we have multiple layers of defense?"
And if an attack goes through, she said that data back up and recovery is that crucial third element.
UMMC says that patients with time-sensitive needs like prescription refills should call their automated triage line at (601) 815-0000.
"Patients requiring immediate assistance will be contacted directly to schedule an urgent care clinic visit," the center said in a statement.
