The Ascension ransomware attack: what happened and the lessons for healthcare
In May 2024, Ascension Health, one of the largest healthcare systems in the U.S., fell victim to a ransomware attack that severely disrupted its operations. The attack encrypted critical systems, including its EHR system, MyChart, forcing staff to rely on manual record-keeping, leading to delays in patient care. Hospitals had to divert emergency services and reschedule surgeries, affecting both routine care and urgent treatments. This incident highlighted the critical vulnerabilities in the healthcare sector’s cybersecurity defenses and underlined the importance of strong incident response plans, data backup strategies, and employee training. The attack serves as a reminder for all critical infrastructure sectors to prioritize cybersecurity to protect sensitive data and ensure uninterrupted services.
Quick answer: Ascension, a large US non-profit health system, reported a ransomware attack in May 2024 that disrupted clinical systems, including electronic health records, and pushed staff onto manual procedures. It later notified affected people. The case shows why healthcare needs segmentation, tested downtime procedures, offline backups, strong identity controls and supplier risk management.
Key takeaways
- Ascension reported a ransomware attack in May 2024 that disrupted clinical systems.
- Hospitals had to run on paper and manual processes during the downtime.
- Later notifications confirmed that personal and health data was affected; check the official figures.
- Healthcare is attractive to attackers because downtime directly threatens patients.
- Key defences: segmentation, MFA, offline backups, downtime drills and supplier controls.
What happened?
In May 2024 Ascension, a large US health system, disclosed that it had detected unusual activity on its network and that systems were affected. Media reports described ransomware. Clinical systems including electronic health records were disrupted, and staff relied on manual processes for a period. Ascension later notified people whose information was involved.
The editor should confirm all details, dates and the number of people affected against Ascension's own statements and official filings, for example with the US Department of Health and Human Services. See the HHS HIPAA pages for how breaches in US healthcare are reported. Public reports named a ransomware group, but attribution claims should be checked against reliable sources before repeating them.
Why is healthcare a target?
- Downtime can harm patients, which increases pressure to pay.
- Hospitals run many connected and older systems that are hard to patch.
- Records are valuable and sensitive.
- Large organisations have many suppliers and entry points.
What does ransomware downtime look like?
When the electronic record is unavailable, staff must work from paper charts, remember allergies and medications without a screen, and phone results across departments. Appointments and procedures may be delayed or diverted. The case shows that a cyber incident is an operational and patient-safety event as well as an IT problem.
What should healthcare organisations do?
- Segment the network so one infected area cannot reach clinical systems.
- Use multi-factor authentication on remote access, email and administrator accounts.
- Keep offline, immutable backups and test restores of the most critical systems first.
- Practise downtime procedures with real drills, including paper forms and communication trees.
- Patch and monitor internet-facing systems and watch for lateral movement.
- Manage supplier risk. Know which third parties can reach your network.
- Prepare an incident plan with clear roles, legal contacts and regulator notification steps.
What applies in India?
Indian hospitals and health-tech firms face the same threats. Report incidents to CERT-In, and note India's data protection rules. See CERT-In for reporting guidance. Related Indian case: the Cipla cyberattack.
What should security learners take from it?
Ransomware response is a mix of technical steps and planning. Reading case studies helps you ask the right questions: what would we do if our records were unavailable tomorrow? See why conduct a ransomware risk assessment for a framework.
Next steps
For incident response skills, see our ECIH incident handler course and SOC course. To see which sectors need security staff, read industries that need ethical hackers.
Related reading
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
