LOUISVILLE, Ky. — Norton Healthcare is recovering from a cyber event that led to the company taking the network offline. This happened last week on May 9.

Norton Healthcare said they also received a fax that contained threats and demands.

Chief Marketing and Communications Officer Renee Murphy said Norton has contacted the FBI.

“At no point did an external force take control of or shut down our network. All of our facilities remain open and patient care continues,” Murphy said.

The investigation remains ongoing, but Murphy said a few isolated instances of some procedures have been rescheduled.

In the meantime, Norton has two priorities on their plate. 

First, they’re working to see what information, if any, may have been accessed and then they want to analyze each application for a security risk assessment to bring it back online.

On Wednesday, the Assistant Vice President of Digital Transformation at UofL, Sharon Kerrick, shared ideas on how to keep information secure.

From her three decades of experience, Kerrick said data gets transferred through various systems all the time.

But when there is some sort of a breach, it allows some to access information. 

“Something we need to always practice and it’s getting to be a routine that we have to do is any of us with our hands on any keyboard, need to change our passwords routinely. Not wait for a system to prompt us to change our password. That may be getting a routine that every eighth of the month that you’re going to change your password,” Kerrick said.

She acknowledges it sounds extreme, but think of it like insurance to routinely change your passwords to keep your accounts safe. 

“And I know that sounds overwhelming to people right now, but it’s getting worse, as we can see. And so even amazing companies like Norton’s who have high-level security people on staff and have done an excellent job of protecting it,” Kerrick explained. “It’s just, you know, the one person in 1000 that makes that violation or accepts that phishing email that then potentially taints the whole body.”

Kerrick also strongly encourages companies to test emergency systems periodically.

“So backup systems can be put even in a place not just for one day later, but even one hour later after the breach or you know, when something’s discovered, and so we can see a mirror image of information and data. And so more than most organizations have that backup, but they never test it,” Kerrick said.

With the recent cyber event with Norton Healthcare, she said to be patient so Norton can reconstruct their backup systems.

“What can we do, you know, as consumers or affiliates with any of those types of organizations that have had that breach is have confidence and know that they’re going to prioritize that, and in this situation, I know they have excellent people, excellent backups, excellent things to support moving forward,” Kerrick said.

Norton said facilities remain open and patient care continues. They said those potentially affected will be notified.

In addition, Kerrick said UofL is offering free courses on digital security.