Healthcare ransomware: restoring systems does not close the data investigation

Tips for Health Care Facilities: Cybersecurity Incident Preparedness and Response

U.S. Food and Drug Administration · 2023-05-01 · Source

This FDA educational video covers healthcare cyber incident preparedness and patient safety during prolonged disruption. It is general guidance from 2023, not reporting or an investigation into the UIC incident.

What did UIC disclose?

On 2 October 2026, the University of Illinois Chicago (UIC) disclosed ransomware that temporarily disrupted some College of Medicine systems. UIC said systems had been restored, with its main network and UI Health patient care unaffected. Some server data had been taken; scope assessment continued. The university reported additional security controls and coordination with law enforcement.

Incident date and unknowns

2 October is the disclosure date; the precise attack start was not given. This source does not identify the initial entry route, technical vulnerability, attacker or number of affected people. These are institutional statements, not independent forensic verification.

Restoring a backup and assessing confidentiality

HHS guidance discusses regular restoration tests and backups kept offline. It also calls for examining access and possible exfiltration evidence beyond recovery. For entities subject to HIPAA, the assessment depends on the circumstances; a working system alone does not establish that information remained protected. This general guidance is not a regulatory finding about UIC.

A separate preparedness track for patient services

The FDA video for healthcare facilities addresses cyber incident preparedness and patient safety during prolonged disruption. We present it as a preparedness resource, not additional evidence about this incident. We draw no conclusion that a medical device was compromised in this case.

Our editorial recommendation: three separate closure records

For a hospital or research institution, we suggest three separate records: which services reopened and under what checks; which datasets were examined and the limits of that examination; and which questions remain unanswered. Give each record an owner, a last verification time and a next review. A statement that systems are working should not replace these records.

A tabletop exercise for PACS, VNA and research teams

Our editorial exercise: without patient data, write a scenario in which the imaging archive, reporting service and research environment return at different times. Ask teams to explain service status, data investigation and user communication separately. The aim is to practise decisions under uncertainty, not simulate an attack or present missing information as fact. This article gives no instructions to change clinical device settings or treatment.