Ascension Health ransomware attack

On 8 May 2024, Ascension — one of the largest non-profit health systems in the United States, with roughly 140 hospitals across 19 states — detected a ransomware intrusion that forced its hospitals back onto pen and paper for weeks. Attributed to the Black Basta ransomware group, the attack diverted ambulances, delayed care, and ultimately exposed the protected health information of nearly 5.6 million patients.

What happened

Ascension's investigation determined that the intrusion began when an employee inadvertently downloaded a malicious file, believing it to be legitimate. From that foothold, the attackers moved through the network and reached 7 of approximately 25,000 servers. On 8 May 2024, IT staff noticed unusual activity, and within hours core systems began failing.

Security researchers and subsequent reporting attributed the attack to Black Basta, a Russian-speaking ransomware-as-a-service operation known for double-extortion tactics against healthcare and critical infrastructure.

Impact

• Ascension's electronic health record (EHR) system, patient portals, phone systems, and the platforms used to order tests, procedures, and medications went offline. Clinical staff reverted to manual, paper-based processes for roughly six weeks.
• Emergency departments at multiple sites went on diversion, redirecting ambulances to non-Ascension facilities, and nurses reported medication and lab-ordering delays that raised patient-safety concerns.
• The data of 5,599,699 individuals was confirmed compromised. Exposed fields included names, addresses, dates of birth, Social Security numbers, medical record numbers, credit card and bank account information, Medicare/Medicaid IDs, driver's license numbers, and passport numbers.
• The disruption hit Ascension's finances hard: same-facility patient volumes fell 8–12% in May and June, contributing to an operating loss of roughly $1.8 billion and a near $1.1 billion net loss for the fiscal year ending June 2024.

Response

Ascension took systems offline, activated downtime procedures, and brought in third-party incident responders. It restored EHR access progressively through June 2024 and offered affected patients two years of free credit monitoring and identity-theft protection. The company has not disclosed paying a ransom. Multiple class-action lawsuits followed the breach notification.

Why it matters

Ascension is a defining case for ransomware as a patient-safety hazard, not merely a data-privacy event. A single mistaken download cascaded into weeks of degraded care across a system serving millions, demonstrating how thin the operational margin is when clinical workflows depend entirely on connected IT. The incident reinforced regulatory and sector pressure — echoed after the contemporaneous Change Healthcare attack — to treat healthcare cybersecurity as critical infrastructure, with hardened identity controls, tested downtime procedures, and network segmentation between administrative and clinical systems.