PHOENIX (3 On Your Side) -- Doctors and nurses at Universal Health Services hospitals across the country are using "back-up processes" to continue caring for patients while the company works to recover from a cyber attack.
Universal Health Services has more than 400 locations. A majority are in the U.S., including 3 facilities in Phoenix; Valley Hospital, Quail Run Behavioral Health, and Calvary Healing Center.
In a statement posted to its website Monday, Universal Health Services confirmed its system is offline because of an "IT security incident." The company did not divulge specifics, but a registered nurse who works at a facility in Arizona told NBC News computers started shutting down on their own over the weekend. A ransomware attack is suspected.
The company was forced to cancel surgeries and divert ambulances at some locations, according to a Wall Street Journal report.
"Unfortunately, the medical industry is a huge target of these ransomware scams," said Ken Colburn, from Data Doctors. "What it means to us as patients is potentially records get compromised, certainly the delivery of services can be impacted."
"The good news," he added. "If it’s a ransomware attack, typically they’re not taking files. They don’t download files. All they’re doing is trying to lock the system down and extract money from the company."
According to Universal Health Services, it does not appear as though patient and employee data have been accessed or copied.
"We implement extensive IT security protocols and are working diligently with our IT security partners to restore IT operations as quickly as possible," the company statement said. "Patient care continues to be delivered safely and effectively."
A spokesperson for Universal Health Services did not immediately respond to 3 On Your Side's request for an interview.
Though the scope of the cyber attack is unclear, Colburn says it is a wake-up call for businesses to review their IT security systems and data recovery plans.
"Ransomware is a growing problem. They don’t care who you are. They know that businesses are much more likely to pay, so maybe it's a wakeup call if you haven’t gone through the exercise, like a fire drill," Colburn said. "You’ve got to know what to do when it happens."
According to the U.S. Department of Health and Human Services, there are 4,000 daily ransomware attacks. If protected health information is compromised in a ransomware attack, the breach must be reported to the federal government.