Loading story…
A ransomware attack hit facility maintenance systems at Health Sciences Centre in Winnipeg, disrupting building operations including door access and heating, ventilation, and air conditioning (HVAC) controls. Shared Health, which oversees the hospital, said patient care and clinical operations continued uninterrupted and that there was no indication patients were affected. The organization said the incident appeared limited to those systems and that no other hospital systems were known to be impacted.
Shared Health said it launched an investigation into the nature and scope of the attack, notified the Manitoba government, and brought in expert assistance to respond. Reporting on the incident highlighted the growing risk ransomware poses to operational technology in healthcare environments, where attacks can disrupt physical infrastructure even when core clinical systems remain online. The attack also follows earlier warnings from Manitoba’s auditor general that Shared Health needed stronger cybersecurity testing and training to improve its readiness for cyber incidents.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In 2024, Manitoba's auditor general warned that Shared Health needed stronger cybersecurity, recommending annual testing and more staff training to improve incident response.
Shared Health disclosed the ransomware incident in a statement on Monday, saying it had launched an investigation into the nature and scope of the attack, notified the provincial government, and sought expert assistance. The hospital also increased security and institutional safety officer presence at entrances because door systems were affected.
A ransomware attack hit Winnipeg's Health Sciences Centre and affected facility maintenance systems, including door access and heating, ventilation, and air conditioning. Shared Health said patient care and clinical operations continued uninterrupted and that no other systems appeared to be affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourcecyberveille.ch
Open sourcecbc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware attacks have repeatedly crippled hospital operations, forcing providers to divert care, lose access to critical systems, and in some cases pay attackers to recover. At Hollywood Presbyterian Medical Center in Los Angeles, malware encrypted files and disrupted the hospital's computer network, prompting executives to pay about **$17,000 in bitcoin** after attackers reportedly reduced an initial demand of **$3.4 million**. The outage interfered with administrative functions and highlighted how cyberattacks on healthcare can create direct patient-safety risks. The threat later scaled across national healthcare systems. The **WannaCry** outbreak spread to nearly 100 countries and severely impacted the UK's **NHS**, knocking hospitals and clinics offline and disrupting appointments and treatment. In Romania, a ransomware attack on a healthcare IT platform left multiple hospitals offline, underscoring how attacks on shared digital infrastructure can cascade across many facilities at once and paralyze care delivery well beyond a single organization.
Jun 29, 2026
A ransomware attack forced the University of Mississippi Medical Center to take major systems offline, disrupting its phone network, broader IT environment, and Epic electronic health record platform. UMMC closed all 35 clinics across Mississippi, canceled appointments including chemotherapy and elective procedures, and shifted staff to paper documentation while keeping hospitals and emergency departments open. The medical center said it was working with the FBI, outside cybersecurity specialists, and vendors to investigate the intrusion and restore operations. UMMC later reopened clinics as systems were gradually brought back online, but the fallout extended beyond the immediate outage. Subsequent reporting said the incident may have exposed the organization to potential federal privacy-law issues, raising questions about whether protected health information was adequately safeguarded during the attack. The case highlights how ransomware against healthcare providers can quickly disrupt patient care, delay treatment, and create regulatory risk alongside operational recovery.
Jun 29, 2026
Dutch healthcare software vendor **ChipSoft** was hit by a ransomware attack that knocked its website offline and disrupted parts of its service footprint, according to **Z-CERT**, the Netherlands' healthcare sector CERT. ChipSoft provides patient record software used by about **80 percent of hospitals in the Netherlands**, making the incident significant for the national healthcare system. While most hospitals were still able to keep patient portals running, local reporting said **11 hospitals** took ChipSoft software offline, including several that depend on it heavily. Z-CERT said it is coordinating with ChipSoft, healthcare institutions, and other partners to assess the impact, and urged organizations to audit ChipSoft-connected systems for unusual traffic and report suspicious activity. The threat actor has not been identified, but the incident adds to mounting concern over ransomware and extortion targeting healthcare providers in the region, following other recent attacks affecting healthcare organizations in the Netherlands and Belgium and renewed warnings about risks to operational continuity and patient safety.
Jun 29, 2026