Loading story…
U.S. federal agencies warned that hospitals and healthcare providers faced an imminent and credible ransomware threat as multiple organizations were already dealing with disruptive intrusions linked to the Ryuk ecosystem. The joint alert from CISA, the FBI, and HHS said the healthcare and public health sector was being actively targeted, while reporting indicated threat actors had discussed deploying ransomware across hundreds of U.S. healthcare facilities.
Several hospitals reported operational impacts consistent with the campaign, including St. Lawrence Health System in New York and Sky Lakes Medical Center in Oregon, while the University of Vermont Health Network disclosed a major network outage under investigation as a possible cyberattack. Security researchers and incident responders tied the activity to Ryuk and associated operators, describing it as a significant escalation that disrupted hospital systems, forced some patient diversions, and raised concern that additional healthcare organizations could be hit.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer reported that Wyckoff Hospital in New York was hit by a Ryuk ransomware attack. The incident was one of the specific hospital compromises cited during the broader healthcare-sector campaign.
CNN reported that hospitals in New York, Nebraska, Ohio, Missouri, and Michigan had been attacked by some form of ransomware since July. This established a broader backdrop of healthcare-sector targeting before the late-October wave.
Alex Holden said Ryuk-affiliated criminals discussed plans to deploy ransomware at more than 400 U.S. healthcare facilities, and Mandiant tracked the responsible cluster as UNC1878. Mandiant also released domains and IP addresses associated with Ryuk activity during 2020 and described multiple hospitals as already significantly impacted.
Federal agencies publicly warned of ransomware activity targeting the Healthcare and Public Health Sector, describing an increased and imminent threat to U.S. hospitals and healthcare providers. The alert accompanied an active federal investigation into the attacks.
The FBI, DHS, and HHS held a conference call with healthcare industry executives and said they had credible information about an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers. Participants said the agencies urged precautions but shared few concrete defensive details or indicators of compromise.
Mandiant said it identified at least three attacks on Tuesday and one on Wednesday, while Recorded Future knew of at least six attacks in the prior 24 hours. The attacks were severe enough to force some hospitals to divert patients to other providers.
The University of Vermont Health Network said it was dealing with a significant and ongoing system-wide network issue and was investigating whether it was caused by a malicious cyberattack. The outage was included among the healthcare incidents unfolding during the warning period.
Ridgeview Medical Center in Minnesota reported unidentified network activity that disrupted certain operations. The facility was cited as another contemporaneous healthcare organization experiencing suspicious cyber-related disruption.
Sky Lakes Medical Center in Oregon confirmed that its computer systems were hit in the same late-October wave. The incident was cited by multiple reports as one of the hospitals already affected.
St. Lawrence Health System in New York said it had been targeted over the previous few days, and reporting cited Ryuk infections affecting hospitals in Potsdam, Massena, and Gouverneur. The health system said the malware was a new Ryuk variant previously unknown to antivirus providers and security agencies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
krebsonsecurity.com
Open sourceedition.cnn.com
Open sourceus-cert.cisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Rhysida** ransomware operation has intensified its focus on healthcare, with reporting and government guidance describing an expanding threat that has hit organizations across Western Europe, the Americas, and Australia. U.S. health-sector alerts and vendor research say the group has targeted education, government, manufacturing, technology, managed service providers, and increasingly **healthcare and public health** entities. Researchers have also linked Rhysida to tactics associated with the defunct **Vice Society** operation, while earlier incidents included the leak of stolen documents from the Chilean Army and suspected involvement in disruptive attacks on medical providers. Security reporting says Rhysida commonly gains initial access through **phishing** and then uses tools such as **Cobalt Strike** and **PowerShell** to disable defenses, delete shadow copies, alter RDP settings, and deploy ransomware. In a newly reported healthcare case, **SIA Medical Centre** was listed as a victim, with the attackers claiming theft of roughly **20,000 patient medical records** along with staff identity documents, plaintext credentials, HR files, and legal and financial records. The allegedly exposed data included names, dates of birth, Medicare numbers, clinical notes, insurance files, passports, driver’s licenses, and login credentials, underscoring the group’s dual risk of operational disruption and large-scale sensitive data exposure in the health sector.
Aug 15, 2026
Confirmed ransomware activity has remained persistently high worldwide, with a Ransomnews dataset logging **9,291 verified attacks** since 2018 and roughly **1,400 to 1,550 incidents annually** since 2023. **LockBit** remains the leading group by confirmed victims since 2019, while **Qilin** leads 2026 year-to-date with 53 confirmed victims, followed closely by **The Gentlemen** with 51. The **United States** accounts for about half of confirmed attacks in the dataset, and healthcare remains one of the most heavily affected sectors, with **1,297 confirmed healthcare incidents** recorded across the full period. Attacks on healthcare accelerated further in the first half of 2026, with overall incidents rising **14%** and attacks on healthcare businesses and service providers jumping **35%** from the second half of 2025 and **110%** from a year earlier. Reporting attributes the shift to criminals targeting central vendors and service providers to reach multiple downstream hospitals and steal large volumes of sensitive data; recent examples include incidents involving **University of Mississippi Medical Center**, **Unimed**, **TriZetto Provider Solutions**, and **QualDerm Partners**. Security leaders say hospitals and clinics still face chronic exposure from legacy medical devices, patching constraints, third-party dependence, limited budgets and staffing, and social-engineering attacks, raising the risk of operational disruption and patient-care delays.
Jul 10, 2026
Ransomware attacks have repeatedly crippled hospital operations, forcing providers to divert care, lose access to critical systems, and in some cases pay attackers to recover. At Hollywood Presbyterian Medical Center in Los Angeles, malware encrypted files and disrupted the hospital's computer network, prompting executives to pay about **$17,000 in bitcoin** after attackers reportedly reduced an initial demand of **$3.4 million**. The outage interfered with administrative functions and highlighted how cyberattacks on healthcare can create direct patient-safety risks. The threat later scaled across national healthcare systems. The **WannaCry** outbreak spread to nearly 100 countries and severely impacted the UK's **NHS**, knocking hospitals and clinics offline and disrupting appointments and treatment. In Romania, a ransomware attack on a healthcare IT platform left multiple hospitals offline, underscoring how attacks on shared digital infrastructure can cascade across many facilities at once and paralyze care delivery well beyond a single organization.
Jun 29, 2026