The Washington PostDemocracy Dies in Darkness

Maryland Health Department remains quiet over when covid-19 data will resume

Maryland Gov. Larry Hogan (R) speaks alongside Maryland Health Secretary Dennis Schrader at a Dec. 1 news conference in Annapolis. Hogan has said that no data was compromised in the cyberattack. (Brian Witte/AP)

Maryland state officials remained quiet Friday, nearly two weeks after a cyberattack interrupted coronavirus data reporting, as residents and state lawmakers escalated calls for fresh numbers.

A Maryland Department of Health spokesman acknowledged the concerns but stopped short of saying when reporting would resume, even as localities across the region see an uptick in coronavirus cases.

“Our IT and cybersecurity teams are working around the clock to restore the full level of reporting, but we do not have a timeline to share right now,” spokesman Andy Owen said in an email.

Days after the cyberattack was reported, Gov. Larry Hogan (R) said the breach appeared not to be as intrusive as once feared and assured the public that no data had been compromised. He also said he expected the data to be back online within a day or two.

The disruptions due to the cyberattack appear to go further than the coronavirus dashboard. Earlier this week, department employees were still unable to access their computers or many portions of the agency’s network.

The state has added a page to the department’s website to provide updates on the incident. On Friday it reported that the department had “detected unauthorized activity involving multiple network infrastructure systems” on Dec. 4.

“Immediate countermeasures were implemented to contain the incident, and servers were taken offline to protect the network,” the post reads. “… In order to prevent additional damage and avoid compromising sensitive health information, we are being methodical and deliberate in restoring network systems while prioritizing health and human safety functions.”

Also Friday, the state reported an increase in hospitalizations — one of few metrics being updated on the coronavirus dashboard. The number of covid-19 patients hospitalized jumped to 1,204, higher than what it was about three weeks ago.

Sen. Katie Fry Hester (D-Howard), who chairs the legislative joint committee on cybersecurity, information technology and biotechnology, said she has not received any additional information since trying to get an update Monday.

“It’s been radio silence,” she said.

There are three issues, Hester said: communications, health care and cybersecurity. On communications, she said “it all seems very quiet,” and on health care “we know that the hospitals are full, but we don’t know where the outbreaks are.”

“Then the cyber issue, the Department of Health has a lot of valuable information that could be valuable on the dark web,” Hester said. “It’s bad news on all three fronts.”

Del. Kirill Reznik (D-Montgomery) sent a letter late Friday to Health Secretary Dennis Schrader asking for an update on the status of operations at the department since the attack. The letter implies that the breach has affected more than the collection and dissemination of coronavirus data. He said he has heard from a number of health-care providers who say that they have not been paid and that claims are not being processed.

Owen said late Friday that Schrader had not received Reznik’s letter.

Hester said she toured one of the state’s mental hospitals Friday to discuss staffing but also saw firsthand how workers at the facility are grappling with the inability to use their laptops because of the attack.

“They can’t email. They can’t order their meals. They can’t order supplies,” she said. “They can’t do anything.”