Maryland’s health department has not released coronavirus case rates for a ninth straight day because of a cyberattack that the governor has described as not as crippling as initially feared.
Meanwhile, department employees on Monday remained unable to access their computers or many portions of the agency’s network, according to records and interviews, and the disruptions were being felt by local health workers trying to stem the spread of the coronavirus — especially as the new omicron variant was discovered in the state.
Wp Get the full experience.Choose your plan ArrowRight
State health officials were focused on, among other things, “gaining full visibility into the affected network infrastructure,” health department spokesman Andy Owen said in an email Monday. He said officials were working to bring network systems back online and restore full reporting capabilities. He did not respond to a request for an interview or answer questions about who may have attacked the system, why or if the attack was ongoing.
Advertisement
Story continues below advertisement
And while Gov. Larry Hogan (R) last week assured the public that the breach appeared not to be as intrusive as once feared, frustrations continued as the health department remained hobbled Monday.
Md. health department employees told to stay off computers after cyberattack
State Sen. Katie Fry Hester (D-Howard), who chairs a legislative joint committee on cybersecurity, information technology and biotechnology, said Monday she has not been able to get any information from Hogan’s administration about what happened or when data will be available.
“The silence has been deafening,” she said. “We’ve got people calling our office who are concerned. We’re in the middle of a pandemic, where the last thing we knew there were three cases of the new variant reported in Baltimore. We need to know what’s going on from a public health standpoint.”
Story continues below advertisement
Hester said she understands not wanting to compromise an existing investigation, but “I do feel like in the absence of any information, the public will assume the worst and that it would be in the public interest to provide us with a substantial update.”
Advertisement
A spokesman for Hogan, Michael Ricci, said in an email Monday that state officials would “continue to provide information for legislators and constituents to the extent possible without compromising the ongoing investigation. As we have previously and repeatedly said, no data was compromised in the network security incident.”
One cybersecurity expert told The Washington Post it’s impossible to know from the outside what sort of attack the department has faced. But, she said, “it sounds like they’re concerned that a lot of their network has been affected, and they don’t know yet what’s happened.”
Story continues below advertisement
“That suggests pretty serious concerns about how deep these actors are embedded in the network,” said Betsy Cooper, director of the Aspen Institute’s Tech Policy Hub and a former Department of Homeland Security official. “If it was a small thing — if it’s just their website or something — you would have expected that to be clear, and they wouldn’t be still seeking to get visibility after” nine days.
Advertisement
In a tweet Monday, the state health department said that its vaccine, hospitalization, and congregate and school outbreak data reports were up to date, adding that the agency continued to “work toward restoring our full COVID-19 data reporting capabilities.”
Some public health officials said they were glad the state at least was able to track coronavirus hospitalizations, a key metric. But they say without case rates, the public remains in the dark about the level of community spread in their jurisdictions and throughout the state.
Story continues below advertisement
According to the state website, on Sunday, there were 1,126 people hospitalized in Maryland for the coronavirus, more than twice as many as on Nov. 19 and the highest number since late April.
Neil J. Sehgal, an assistant professor of health policy and management at the University of Maryland School of Public Health, said that in the absence of other Maryland coronavirus data, those tracking trends can look at what is happening in the surrounding area. “That is not to say that what is happening in D.C. is exactly what is happening in Maryland,” he said, “but you get a pretty good reflection of what is happening when you look across the border.”
A division of Virginia’s General Assembly is dealing with ransomware attack
Local public health workers gave varying accounts Monday of the severity of problems they faced from the situation.
Advertisement
Story continues below advertisement
Nilesh Kalyanaraman, the health officer for Anne Arundel County, said the past week has been “challenging” but “by and large” Anne Arundel has been able to continue providing other health department services.
“A lot of platforms are in the cloud or hosted elsewhere,” he said, noting that his county and other large jurisdictions maintain their own information technology and are not as reliant on the state’s system.
Kalyanaraman said employees have been able to continue doing things such as contact tracing — “it’s just going to be a little bit slower.”
A public health worker in another local jurisdiction, who spoke on the condition of anonymity because they did not have authorization to speak on the matter, said Monday that the lack of new coronavirus case information has hamstrung that jurisdiction’s contact-tracing efforts.
Advertisement
Story continues below advertisement
“We’re doing what we can locally to try to find cases,” the worker said. “But without the state that has always provided this umbrella of global covid surveillance, we’re just getting dribs and drabs of cases.”
The lack of information has made it difficult or impossible to identify trends of new cases in places such as schools and nursing homes, the worker said.
“At the local health department level, there’s this sense of disconnect — nobody really knows what’s going on,” the worker said. “There’s no sense of, like, how does this end?”