Loading story…
JPS Health Network in Fort Worth, Texas took its network offline in a controlled response to suspicious activity detected in its technology environment. The disruption, which began August 3, affected online services and phone lines across the hospital system, clinics, and other sites; facilities remained open, but clinicians and staff shifted to manual procedures.
JPS restored its core network on August 14 and anticipated restoring patient access to MyChart by August 16. Patients continued to report fallout from the nearly two-week outage after core systems were restored, underscoring operational and care-access impacts from the incident.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
JPS Health Network restored its core network on August 14 and said patients were expected to regain MyChart access by August 16.
JPS Health Network detected suspicious activity in its technology environment and began a controlled network downtime on August 3. The nearly two-week disruption affected online services and telephone lines, while facilities stayed open and staff used manual procedures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourcejpshealthnet.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Harris Health, a major healthcare provider in Texas, is notifying 5,000 patients about a significant insider data breach that persisted for over ten years. The breach involved a former employee who accessed electronic health records (EHRs) without a legitimate work-related reason from January 4, 2011, to March 8, 2021. The organization discovered the unauthorized access on February 10, 2021, and immediately launched an internal investigation with the assistance of a forensic firm. Upon confirming the breach, Harris Health reported the incident to the FBI and terminated the employee responsible for the unauthorized access. The investigation revealed that the former employee had disclosed some patient information to unauthorized individuals, raising concerns about the potential misuse of sensitive health data. Due to the ongoing FBI investigation, Harris Health was required by law enforcement to delay notifying affected patients until it would not impede the inquiry. Only after receiving explicit clearance from the FBI was Harris Health able to begin the notification process. The breach affected patients across Harris Health’s extensive network, which includes two trauma center hospitals and 37 clinics, health centers, and specialty locations. The organization emphasized that it is now notifying patients as quickly as possible following the law enforcement directive. The breach notification process is part of Harris Health’s compliance with data security and privacy regulations, and the organization has reiterated its commitment to protecting patient information. The incident highlights the risks posed by insider threats within healthcare organizations, especially given the long duration of undetected access. Harris Health has not been able to determine which specific sensitive information was disclosed in every case, but the potential exposure includes personal and medical data. The organization’s response included collaboration with law enforcement and external forensic experts to assess the scope and impact of the breach. The case underscores the importance of robust monitoring and access controls for EHR systems to prevent and detect unauthorized activity. Harris Health’s experience serves as a cautionary example for other healthcare entities regarding the need for vigilance against insider threats. The breach has prompted a review of internal security policies and procedures to mitigate the risk of similar incidents in the future. The FBI’s involvement and the protracted nature of the investigation demonstrate the complexity of insider breaches in the healthcare sector.
Jul 12, 2026
Heywood Healthcare, a nonprofit healthcare system in North Central Massachusetts, experienced a significant cyberattack that forced the organization to take its IT network offline. The incident affected both Heywood Hospital in Gardner, a 134-bed facility, and Athol Hospital, a 25-bed critical access hospital in Athol, as well as associated medical groups and care facilities. As a direct result of the attack, the hospitals were unable to accept emergency care patients transported by ambulance, leading to the diversion of ambulances to other facilities. Radiology and laboratory services, including CAT scan imaging, were rendered unavailable, impacting the hospitals' ability to provide critical diagnostic services. The Central Massachusetts Emergency Medical Systems Corp. issued guidance for ambulances to transport stroke patients to the next nearest primary stroke service hospital, as the affected hospitals' imaging services would be down until further notice. In addition to clinical disruptions, the cyberattack also impacted communication systems, with email and phone services affected, further complicating coordination and response efforts. Despite these challenges, Heywood Healthcare continued to care for inpatients already admitted to both hospitals. The organization did not disclose the specific nature of the cyberattack, such as whether it involved ransomware or data exfiltration, but the operational impact was severe enough to necessitate a full network shutdown. The incident highlights the vulnerability of healthcare infrastructure to cyber threats and the cascading effects on patient care and regional emergency response. Local authorities and healthcare partners were notified, and contingency plans were activated to manage patient care and redirect emergency services. The disruption to radiology and laboratory services not only affected emergency care but also routine diagnostics for existing patients. The hospitals' inability to accept ambulance patients placed additional strain on neighboring healthcare facilities, which had to absorb redirected emergency cases. The attack underscores the importance of robust business continuity and disaster recovery planning in the healthcare sector. Heywood Healthcare's response included ongoing assessment and restoration efforts, though no timeline for full service restoration was provided. The incident also raised concerns about the security of patient data, though no evidence of data compromise was reported at the time. The healthcare system's transparency in communicating with the public and emergency services was noted as a critical component of the response. The event serves as a reminder of the critical interdependencies between IT systems, clinical operations, and emergency medical services in modern healthcare environments.
Jul 12, 2026
Signature Healthcare in Brockton, Massachusetts said a cyberattack disrupted clinical and administrative operations across its hospital and outpatient network, forcing the diversion of ambulance traffic and taking electronic health records and the patient portal offline. The incident also halted prescription filling at the organization's two retail pharmacies and temporarily canceled chemotherapy infusion services, while inpatient care, emergency walk-in services, surgeries, and some procedures continued. The provider said its medical group and urgent care practices remained open, although patients could face delays as response efforts continued. The disruption adds to a broader run of cyber incidents affecting U.S. healthcare organizations, including a February ransomware attack on the University of Mississippi Medical Center and a January breach at Nacogdoches Memorial Hospital that affected more than 257,000 people; Signature Healthcare had not disclosed further technical details about the attack at the time of reporting.
Jun 29, 2026