$800K Weekly: Hospital Cyberattack Forces 5 Months of Manual Operation
In April of this year, a cyberattack crippled the operations of Juan F. Luis Hospital in the U.S. Virgin Islands, causing months-long disruptions to its electronic systems, halting automated document workflows, and inflicting severe financial losses. According to Chief Executive Officer Darlene Baptiste, the damages amounted to between $750,000 and $800,000 per week, though no patient or staff data was compromised during the incident.
Baptiste detailed the aftermath of the attack during the public forum “Conversations on Care,” noting that the breach occurred on the morning of April 26, completely disabling the hospital’s infrastructure. Immediately upon detection, the network was fully shut down, and operations were transitioned to manual mode. All medical and administrative tasks had to be carried out on paper, resulting in billing delays and cash flow disruptions.
An internal investigation revealed that the attackers had infiltrated the system through two unprotected local servers, exploiting an unpatched vulnerability. Once inside, they gained access to one of the network drives, though, as Baptiste emphasized, no personal or medical records were compromised. Following the breach, hospital IT staff, in collaboration with federal agencies and external cybersecurity firms, conducted a comprehensive forensic review of every workstation, cleansing all systems and initiating a phased recovery process.
For nearly five months, staff operated under so-called “downtime conditions” — without electronic records or automated logs. Only by September did the hospital begin its gradual return to digital operations, migrating its infrastructure to the cloud. According to the administration, 80–85% of employees have now resumed using the Meditech electronic medical record system, while restoration of the financial and administrative modules remains ongoing.
The cyber incident became a catalyst for a complete modernization of the hospital’s IT infrastructure. JFL has since adopted cloud-based services featuring multi-layered security, redundant backups, and continuous threat monitoring. A Cyber Operations Center has been established to track intrusion attempts in real time and produce analytical reports on global attack trends. Leadership emphasized that the new architecture ensures multi-tiered data redundancy and instant incident response.
Although the recovery demanded significant financial investment, the administration regards these measures as vital for long-term resilience. Baptiste remarked that the hospital had “literally learned its lesson at an enormous cost” and would not allow such an event to occur again. She expressed deep gratitude to the medical and technical staff, who maintained operations throughout months of disruption. At the height of the crisis, teams worked around the clock, manually registering patients and processing documents across fifteen terminals.
Hospital leadership described the attack as a harsh yet transformative experience, one that ultimately strengthened its defenses and enhanced infrastructural endurance.
“We have emerged stronger and better prepared to confront future threats,” Baptiste affirmed. The final federal investigative report has yet to be published, but the hospital has nearly completed its transition to a modernized, fully secure platform, now deemed ready for safe and stable operation.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
