University Hospitals Cyber Disruption Leaves Patient-Facing Systems Offline

University Hospitals (UH), a Cleveland healthcare system, reported that patients still could not access its public websites and MyChart roughly two weeks after the organization detected “unusual activity” on its servers on October 22. UH disconnected affected systems from the internet “out of an abundance of caution” and said it had no estimated timeline for restoring them. The disruption is significant for healthcare operators and contractors because it illustrates how a cyber incident can leave patient-facing digital services unavailable even while some internal clinical systems continue to function.

The reported effects were not uniform across UH’s technology environment. The hospital system’s clinician intranet, which enables doctors to access patient records, remained fully operational, while public websites and MyChart were unavailable. UH encouraged patients with questions to contact their doctors’ offices directly and asked them to keep in-person appointments. Virtual visits were being shifted to phone, Zoom, or in-person appointments. This distinction is relevant to continuity planning: incident response must account for the dependencies and recovery priorities of both public-facing platforms and systems that support direct clinical work.

UH had not answered questions about the type of attack detected. It also had not disclosed whether patient information was accessed and had not made a breach disclosure to the U.S. Department of Health and Human Services (HHS), according to the supplied reporting. Those limits matter for procurement analysis: the incident does not establish a confirmed data breach, a regulatory finding, or a resulting UH acquisition. Healthcare IT and cybersecurity companies may treat the disruption as a market signal for incident response, forensic investigation, secure recovery, and continuity-of-care services—not as an active contract opportunity.

Cory Scott, executive director of the Cybersecurity Center at Cleveland State University’s College of Law, said research on ransomware incidents affecting U.S. hospitals and healthcare providers found an average recovery period of 16.5 days. “This is not, unfortunately, an unusual amount of time yet,” Scott said. He described a methodical response in which organizations first contain potential damage, investigate the source and scope of an incident, remove an attacker, rebuild compromised systems, and sustain essential care while the investigation proceeds. The reporting also cites cybersecurity research firm Comparitech, which said ransomware attacks on the healthcare sector averaged 3.33 attacks per day in the third quarter of 2026, a new high. The figures reinforce demand-side interest in resilient healthcare operations, but they do not confirm that UH experienced ransomware or intends to procure services.

• Incident timeline: UH detected “unusual activity” on its servers on October 22 and removed certain websites and MyChart from the internet; roughly two weeks later, it had no estimated restoration date.
• System impact: UH’s public websites and MyChart remained unavailable, while the clinician intranet used to access patient records was reported fully operational.
• Patient-care continuity: UH encouraged patients to contact doctors’ offices and keep in-person appointments; virtual visits were moved to phone, Zoom, or in-person formats.
• Attack details remain unconfirmed: UH had not specified the type of attack, and the reporting did not establish that ransomware was involved.
• Disclosure status: UH had not disclosed whether patient information was accessed and had not made a breach disclosure to HHS, according to the supplied source.
• Recovery benchmark: Research cited by Cory Scott found an average recovery time of 16.5 days for ransomware attacks on U.S. hospitals and healthcare providers.
• Healthcare threat environment: Comparitech reported an average of 3.33 ransomware attacks per day against the healthcare sector in the third quarter of 2026, described as a new high.
• Operational priorities: Scott identified containment, investigation, attacker removal, system rebuilding, and preservation of core services such as labs, imaging, and scheduling as concurrent recovery demands.
• Procurement implication: Incident response, system recovery, and continuity-of-care capabilities may be relevant market areas for healthcare organizations; no solicitation or confirmed UH procurement was identified.
• Contractor takeaway: Monitor for any future UH or broader healthcare procurement announcements, but do not treat the reported disruption itself as evidence of an open requirement or award.