'Could have resulted in the loss of lives' Cyberattack on OneBlood nearly cut off Florida's blood supply

TAMPA, Fla. — A cyberattack at the end of July nearly cut off the blood supply to local hospitals.

“It is absolutely a situation that could have resulted in the loss of lives," Mary Mayhew, President & CEO of the Florida Hospital Association told the ABC Action News I-Team.

OneBlood, which serves more than 250 hospitals in the Southeast, was hit by a ransomware attack on July 29. The attack disabled the system that allows it to quickly label and distribute blood.

The I-Team dug into how close Florida came to running out of blood and how OneBlood, hospital systems, and state and federal leaders came together to make it through the attack and recover within 10 days.

OneBlood hit by ransomware attack, impacting blood supply to Florida hospitals

The simple act of donating life-saving blood was complicated because hackers are now targeting blood banks.

Nick Hoffschneider went to South Tampa's OneBlood Center to make a donation at the recommendation of his doctor.

"You've got to help people out. Maybe save some lives," Hoffschneider said.

Before his donation — or any donation can be used, it must be labeled. Hackers attacked that system in July.

It's a form of cyberterrorism that the Florida Hospital Association told the I-Team was tied to Russian hackers, exposing the vulnerability of our country's blood banks.

With the labeling system under attack, OneBlood employees were forced to manually label each donation, drastically slowing deliveries to local hospitals.

"One of our larger hospitals generally receives 80 units of platelets a day. They received nine units today. A mom delivering a baby that is hemorrhaging could use immediately nine units of platelets. That's the difference,” Mayhew told the I-Team on July 31. "So hospitals are having to make very difficult decisions, but trying to triage and prioritize those truly urgent surgeries that are critically important and life-saving.”

“Something that may take 30 seconds to label a blood product, may now take 5 or 6 minutes," Susan Forbes, OneBlood's senior vice president of corporate communications and public relations told the I-Team.

Forbes said the most significant impact was on Type O blood and platelets, which only have a five-day shelf-life.

“These are the products that are in the highest demand by hospitals, and so that's where we started to see that immediate need," Fobes said.

Mayhew said platelets are used in high-risk procedures and surgeries and have a "critical, critical need for this blood supply that was completely cut off."

But when the attack happened, only the medical community knew something was very wrong.

“When this was first occurring, there was not a public acknowledgment that this was a cyberattack," Mayhew said.

Mayhew told the I-Team that two days had passed since the public was told.

“Terms were being used like, this is going to affect ‘elective’ procedures — that is not what was occurring," she said. "Certain cancer treatments could not be provided because they simply did not have the blood supply, the platelets that were needed.”

OneBlood said it worked with a task force of blood suppliers to bring in adequately labeled blood from across the country while hospitals postponed surgeries.

“This was about prioritizing and organizing what needed to be done, and to do that really fast, because we knew that the blood supply was the issue here. I mean, this is a life-saving resource," Forbes said.

Mayhew said it was days before they knew specifics surrounding just how dire the situation was.

“It wasn't until Friday that we saw data about the level of dependency on the national blood supply," she said. "At one point, we were receiving over 80% of the platelets for Florida's hospitals from the national blood supply.”

Mayhew worried about what would have happened if there had been a crisis and demand for blood in another part of the country at that time.

"We would not have been able to receive the volume of platelets from the national blood supply, which we critically needed in Florida, which is why this really is an issue of national priority," Mayhew said.

In June, Synnovis, a provider of pathology services that partners with major hospitals in London, was the victim of a ransomware cyberattack. The attack impacted blood transfusions and test results, forcing hospitals to cancel operations and divert patients.

“It's really happening everywhere now," cybersecurity expert Scott Schober said.

Schober said the attack exemplifies how medical care is now a target.

“The part that the part that scares me the most is it goes an additional layer each time," Schober said. "Now it's a hospital, and now it's those parties that are third parties that work closely at the hospital. In other words, they're really covering all basis. Everybody is a target," Schober said.

Watch more from Florida Hospital Association President

“It is absolutely a situation that could have resulted in the loss of lives. We were able to provide the the resources to hospitals, they were able to to make the clinical decisions to guard against that. But that doesn't mean that we can quickly put this in our rear view mirror. We absolutely have to understand what this meant for our blood supply and our state and our country. We've got to understand the seriousness of these cyber attacks," Mayhew said. "We can't walk away from this without truly reexamining all aspects of it, immediately identifying opportunities to both learn from it, but to strengthen our blood supply.”

During the OneBlood outage, the Florida Hospital Association says it worked with the Division of Emergency Management, Department of Health and Agency for Health Care Administration at the state level, and on the federal/national level, the United States Department of Health and Human Services, Federal Drug Administration, Administration for Strategic Preparedness and Response, Association for the Advancement of Blood and Biotherapies (AABB) and Health Sector Coordinating Council.

The Florida Hospital Association told the I-Team, "We will continue collaborating with these agencies to build a robust after-action report."

OneBlood reported that it was able to return to normal distribution within ten days.

“This was an unprecedented situation that we faced, but we faced it head on, we faced it quickly, we mitigated the situation fast, and we were able to continue our operations for the most part, despite what we were facing, because we simply cannot stop. Under no circumstances can we not continue to move that blood supply forward," Forbes told the I-Team.

The nonprofit is working with cybersecurity specialists and following their advice to prevent a future attack.

Visit OneBlood's website to find where you can donate blood in your area.