Loading story…
Heywood Healthcare, a nonprofit healthcare system in North Central Massachusetts, experienced a significant cyberattack that forced the organization to take its IT network offline. The incident affected both Heywood Hospital in Gardner, a 134-bed facility, and Athol Hospital, a 25-bed critical access hospital in Athol, as well as associated medical groups and care facilities. As a direct result of the attack, the hospitals were unable to accept emergency care patients transported by ambulance, leading to the diversion of ambulances to other facilities. Radiology and laboratory services, including CAT scan imaging, were rendered unavailable, impacting the hospitals' ability to provide critical diagnostic services. The Central Massachusetts Emergency Medical Systems Corp. issued guidance for ambulances to transport stroke patients to the next nearest primary stroke service hospital, as the affected hospitals' imaging services would be down until further notice. In addition to clinical disruptions, the cyberattack also impacted communication systems, with email and phone services affected, further complicating coordination and response efforts. Despite these challenges, Heywood Healthcare continued to care for inpatients already admitted to both hospitals. The organization did not disclose the specific nature of the cyberattack, such as whether it involved ransomware or data exfiltration, but the operational impact was severe enough to necessitate a full network shutdown. The incident highlights the vulnerability of healthcare infrastructure to cyber threats and the cascading effects on patient care and regional emergency response. Local authorities and healthcare partners were notified, and contingency plans were activated to manage patient care and redirect emergency services. The disruption to radiology and laboratory services not only affected emergency care but also routine diagnostics for existing patients. The hospitals' inability to accept ambulance patients placed additional strain on neighboring healthcare facilities, which had to absorb redirected emergency cases. The attack underscores the importance of robust business continuity and disaster recovery planning in the healthcare sector. Heywood Healthcare's response included ongoing assessment and restoration efforts, though no timeline for full service restoration was provided. The incident also raised concerns about the security of patient data, though no evidence of data compromise was reported at the time. The healthcare system's transparency in communicating with the public and emergency services was noted as a critical component of the response. The event serves as a reminder of the critical interdependencies between IT systems, clinical operations, and emergency medical services in modern healthcare environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Two hospitals in Massachusetts were reported as experiencing service disruptions caused by a cyberattack. The available references do not provide additional technical details, victim names, or response actions beyond the disruption itself.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Signature Healthcare in Brockton, Massachusetts said a cyberattack disrupted clinical and administrative operations across its hospital and outpatient network, forcing the diversion of ambulance traffic and taking electronic health records and the patient portal offline. The incident also halted prescription filling at the organization's two retail pharmacies and temporarily canceled chemotherapy infusion services, while inpatient care, emergency walk-in services, surgeries, and some procedures continued. The provider said its medical group and urgent care practices remained open, although patients could face delays as response efforts continued. The disruption adds to a broader run of cyber incidents affecting U.S. healthcare organizations, including a February ransomware attack on the University of Mississippi Medical Center and a January breach at Nacogdoches Memorial Hospital that affected more than 257,000 people; Signature Healthcare had not disclosed further technical details about the attack at the time of reporting.
Jun 29, 2026
A cyberattack hit the Patriot Regional Emergency Communications Center in Pepperell, Massachusetts, disrupting computer systems used by town and public safety agencies across several northern Massachusetts communities. Officials said the incident affected police and fire operations in Ashby, Dunstable, Pepperell, Townsend, and other towns served by the regional dispatch hub, while non-emergency and business phone lines were knocked offline. Emergency `9-1-1` services remained operational despite the outage. Municipal officials said they brought in insurance representatives and outside cybersecurity responders and notified federal law enforcement as the investigation began. Authorities are still determining whether any data was accessed or stolen, and no threat actor had publicly claimed responsibility at the time of reporting. The affected center also supports emergency call intake and dispatch and is connected to the CodeRED notification platform, underscoring the continued exposure of municipal and emergency communications systems to disruptive cyber incidents.
Jun 29, 2026
Multiple healthcare-sector cyber incidents were reported, including ongoing fallout from a major U.S. provider ransomware event. **Kettering Health** continues to face escalating legal exposure from a 2025 ransomware attack attributed to **Interlock**, which allegedly stole **941 GB** of data and encrypted systems; the disruption forced shutdown of roughly **600 applications**, a temporary shift to paper workflows, and delays to care while systems (including *Epic* EHR) were restored. Dozens of patient lawsuits have been filed and consolidated in Ohio, with claims focused not only on data theft but also alleged **delayed or denied medical care** during the outage. Separately, healthcare vendor **Insightin Health** disclosed a 2025 security incident involving its use of the *GoAnywhere* managed file transfer tool, reporting that an unauthorized party accessed GoAnywhere by exploiting an **“unknown design flaw”** and potentially accessed files on a subset of servers between **Sept 17–23, 2025**; impacted data may have included names, provider names, insurance information, and member IDs (no SSNs or financial data reported). In Europe, the Independent Public Regional Hospital in **Szczecin, Poland** reported a March 2026 cyberattack that **encrypted parts of hospital data**, disrupted digital operations, and forced a temporary return to paper-based processes, while the hospital stated urgent care continued despite slower administration.
Jul 12, 2026