Ohio’s second-largest health system cut itself off from the internet on October 22 after staff found unusual activity on its servers, and the outage is now stretching into a second week with billing still down.
Cleveland-based University Hospitals disconnected systems as a precaution, taking MyChart and its public website offline. In a statement, the system said there was no impact on patient care at the time, though it has begun rescheduling appointments and elective procedures and warned disruptions could run into next week.
By Friday evening, UH said it had started reconnecting to some external partners. Video visits and billing functions remained unavailable.
The trigger was server activity, not a ransom note – the system has not used the word ransomware, and no extortion group has claimed the incident.
The shutdown is drawing outside attention. Hall Attorneys said it is investigating the October 2026 disruption and potential claims involving UH and Epic Systems, maker of MyChart, while state and local outlets reported no confirmation of data theft.
The episode is a case study in containment cost for hospital leaders. Pulling the network is the right instinct when server behavior is unexplained, but the clinical bill arrives fast: rescheduled procedures, patients locked out of results, paper workflows, and revenue-cycle systems frozen while billing queues keep growing. It also lands one week after Parkview Health in Indiana restored MyChart only partially following a similar precautionary disconnect, and after Quest Diagnostics pulled a lab ordering portal used by hospitals nationwide.
Three health systems in one week separating from their own networks suggests defenders now treat unexplained server activity as a breach until proven otherwise. Incident playbooks should plan for a week of downtime, not a day.
