Loading story…
Signature Healthcare in Brockton, Massachusetts said a cyberattack disrupted clinical and administrative operations across its hospital and outpatient network, forcing the diversion of ambulance traffic and taking electronic health records and the patient portal offline. The incident also halted prescription filling at the organization's two retail pharmacies and temporarily canceled chemotherapy infusion services, while inpatient care, emergency walk-in services, surgeries, and some procedures continued.
The provider said its medical group and urgent care practices remained open, although patients could face delays as response efforts continued. The disruption adds to a broader run of cyber incidents affecting U.S. healthcare organizations, including a February ransomware attack on the University of Mississippi Medical Center and a January breach at Nacogdoches Memorial Hospital that affected more than 257,000 people; Signature Healthcare had not disclosed further technical details about the attack at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Reporting on the ongoing Signature Healthcare disruption identified the Anubis ransomware operation as the group behind the attack. The report also said federal and state officials were assisting the investigation as the hospital continued recovery efforts.
As part of the disruption, Signature Healthcare diverted ambulance traffic, took its electronic health records and patient portal offline, suspended prescription fulfillment at two retail pharmacies, and temporarily canceled chemotherapy infusion services. Inpatient care, emergency walk-in services, surgeries, and some procedures continued, while urgent care and medical group practices remained open with delays.
Signature Healthcare in Brockton, Massachusetts said it discovered a cyberattack on Monday that disrupted clinical and administrative operations. The incident affected hospital and outpatient services and prompted an ongoing response.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcehipaajournal.com
Open sourceeu.enterprisenews.com
Open sourcebankinfosecurity.com
Open sourcesignature-healthcare.org
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Heywood Healthcare, a nonprofit healthcare system in North Central Massachusetts, experienced a significant cyberattack that forced the organization to take its IT network offline. The incident affected both Heywood Hospital in Gardner, a 134-bed facility, and Athol Hospital, a 25-bed critical access hospital in Athol, as well as associated medical groups and care facilities. As a direct result of the attack, the hospitals were unable to accept emergency care patients transported by ambulance, leading to the diversion of ambulances to other facilities. Radiology and laboratory services, including CAT scan imaging, were rendered unavailable, impacting the hospitals' ability to provide critical diagnostic services. The Central Massachusetts Emergency Medical Systems Corp. issued guidance for ambulances to transport stroke patients to the next nearest primary stroke service hospital, as the affected hospitals' imaging services would be down until further notice. In addition to clinical disruptions, the cyberattack also impacted communication systems, with email and phone services affected, further complicating coordination and response efforts. Despite these challenges, Heywood Healthcare continued to care for inpatients already admitted to both hospitals. The organization did not disclose the specific nature of the cyberattack, such as whether it involved ransomware or data exfiltration, but the operational impact was severe enough to necessitate a full network shutdown. The incident highlights the vulnerability of healthcare infrastructure to cyber threats and the cascading effects on patient care and regional emergency response. Local authorities and healthcare partners were notified, and contingency plans were activated to manage patient care and redirect emergency services. The disruption to radiology and laboratory services not only affected emergency care but also routine diagnostics for existing patients. The hospitals' inability to accept ambulance patients placed additional strain on neighboring healthcare facilities, which had to absorb redirected emergency cases. The attack underscores the importance of robust business continuity and disaster recovery planning in the healthcare sector. Heywood Healthcare's response included ongoing assessment and restoration efforts, though no timeline for full service restoration was provided. The incident also raised concerns about the security of patient data, though no evidence of data compromise was reported at the time. The healthcare system's transparency in communicating with the public and emergency services was noted as a critical component of the response. The event serves as a reminder of the critical interdependencies between IT systems, clinical operations, and emergency medical services in modern healthcare environments.
Jul 12, 2026
Several healthcare providers in the United States have recently disclosed significant data breaches resulting from cyberattacks, with patient and employee information being compromised. AllerVie Health, based in Texas, confirmed unauthorized access to its network, exposing sensitive data such as names, Social Security numbers, and insurance details, allegedly due to a ransomware attack by the Anubis group. The attackers claim to have stolen records of over 30,000 patients, and affected individuals have been offered credit monitoring and identity theft protection. In a separate incident, OrthopedicsNY, a healthcare provider in New York, suffered a breach in 2023 after attackers gained remote access using compromised credentials, leading to the exposure of data belonging to more than 650,000 patients and employees. The New York Attorney General secured a $500,000 penalty from OrthopedicsNY for failing to implement adequate security measures, and the provider is now required to enhance its data protection practices. Additionally, Singing River Health System in Mississippi reported a cyber incident that led to the temporary shutdown of its patient portal and internet access as a precaution. While the threat was reportedly mitigated, the investigation is ongoing to determine if patient records were accessed. These incidents highlight the ongoing risks faced by healthcare organizations from ransomware groups and other cybercriminals, as well as the increasing regulatory scrutiny and financial penalties for failing to protect sensitive health information. Impacted organizations are responding with offers of credit monitoring and reviews of their security policies, but the breaches underscore the need for robust cybersecurity measures in the healthcare sector.
Jun 29, 2026
A ransomware attack forced the University of Mississippi Medical Center to take major systems offline, disrupting its phone network, broader IT environment, and Epic electronic health record platform. UMMC closed all 35 clinics across Mississippi, canceled appointments including chemotherapy and elective procedures, and shifted staff to paper documentation while keeping hospitals and emergency departments open. The medical center said it was working with the FBI, outside cybersecurity specialists, and vendors to investigate the intrusion and restore operations. UMMC later reopened clinics as systems were gradually brought back online, but the fallout extended beyond the immediate outage. Subsequent reporting said the incident may have exposed the organization to potential federal privacy-law issues, raising questions about whether protected health information was adequately safeguarded during the attack. The case highlights how ransomware against healthcare providers can quickly disrupt patient care, delay treatment, and create regulatory risk alongside operational recovery.
Jun 29, 2026