Ascension ransomware attack (2024)

The Ascension attack is the ransomware case that hit, from May 8, 2024, one of the largest nonprofit hospital networks in the United States, roughly 140 Catholic hospitals across about twenty states. According to the system, entry came through a malicious file that someone working at one of its facilities downloaded, believing it legitimate. The electronic health record, medication ordering and scheduling went down or were shut off as a precaution. Several emergency departments diverted ambulances, and the health record was not restored everywhere until mid-June. The press attributed the attack to Black Basta, which made no public claim. In December 2024, the breach notice filed with the Maine attorney general covered about 5.6 million people. Results for the fiscal year ended June 30, 2024 showed an operating loss of around 1.8 billion dollars that includes the attack's effect, and volumes fell 8% to 12% in May and June. Class actions were filed as early as May 12 and 13, in Illinois and Texas. For the underwriter, Ascension is the case of a network with centralized IT. One compromised access point halts facilities thousands of miles apart, and business interruption is measured across the whole group. The file feeds the debate over per-facility sublimits and over what counts as a single loss when many states are hit on the same day.