Ransomware Attacks Hit US Healthcare Providers, Exposing Sensitive Patient and Employee Data

Steve Alder, writing in The HIPAA Journal, reports on a string of cybersecurity incidents and ransomware attacks targeting healthcare providers, posing a persistent threat to protected health information.

Most notably, Cumberland County Hospital in Kentucky has disclosed a data breach affecting over 36,000 individuals.

Two ransomware groups have claimed responsibility for other recent cyberattacks. The Global group claimed an attack against All Nations Health Center, which serves Native American communities in Montana, and the Qilin ransomware group attacked The Health Trust in California.

In all instances, the cybercriminals threaten to publish stolen data unless ransoms are paid.

Cumberland County Hospital detected unauthorized access to its systems on April 3, 2025, prompting immediate action to shut down networks and disable data sharing.

A forensic investigation later revealed that attackers had access between February 21 and April 3, compromising files containing sensitive patient and employee data.

Although electronic medical records were not accessed, information exposed in the ransomware attacks included Social Security numbers, treatment details, insurance and billing data, and employee HR documents.

The hospital has notified affected individuals and is offering a year of free credit monitoring and identity protection.

For healthcare entities’ legal counsel, these incidents underscore the operational risks tied to storing personal health data. Incident response planning, regulatory compliance, breach notification protocol, and third-party risk management are bottom-line requirements.

Ensure that clients proactively pursue cybersecurity measures, contractually mandate vendor responsibilities, and incorporate breach response clauses to mitigate liability in the event of an attack.