Many ransomware attacks begin through a phishing email or remote access to one workstation exposed to the Internet, and then attackers expand their control through theft of administrator credentials and moving laterally to other workstations or servers. A major concern recently has been the critical vulnerability known as ZeroLogon, or CVE-2020-1472, which was partially fixed by the August 2020 patch from Microsoft. If the August patch has not been applied to Domain Controllers in a Windows network, this vulnerability gives attackers a fast and simple way to completely take over the domain from anyone computer that they have access to. While an attack that shuts down operations at one or two facilities is bad, this type of attack that affects hospitals across the country all at once is exactly what could happen if an attacker recklessly exploits such a vulnerability. Whether the UHS system has been affected by this or not, it is wise for all companies to verify that the August patches from Microsoft have been fully rolled out to all Domain Controllers.

Sources: https://www.reddit.com/r/hacking/comments/j17aj1/cyberattack_on_uhs_hospitals_nationwide_last_night/?sort=new
https://www.zdnet.com/article/uhs-hospital-network-hit-by-ransomware-attack/
https://www.bleepingcomputer.com/news/security/uhs-hospitals-hit-by-reported-country-wide-ryuk-ransomware-attack/