Ascension detected unusual activity on May 8, 2024, isolated affected systems and later confirmed a ransomware attack. The incident disrupted electronic health records, MyChart, phones, medication and test ordering, pharmacies, emergency transport and some elective care. Ascension reported that its electronic health record and clinical workflows were restored by June 20, 2024, although downtime data still required reconciliation. A later breach notice said a cybercriminal obtained copies of certain files containing personal information on May 7 and May 8. That finding establishes unauthorized file access, but it does not mean every patient’s complete medical record was copied.
What happened to Ascension?
Ascension initially described a cybersecurity event after detecting unusual activity on selected technology systems on May 8, 2024. It disconnected or restricted affected systems, began remediation and activated downtime procedures. The health system later confirmed that the event was ransomware. Its initial notice said the investigation was still determining whether information had been affected: Ascension’s network-interruption update.
Ascension operated approximately 140 hospitals across 19 states and Washington, D.C. during the incident period, but the effect was not identical at every facility or service line. Mandiant assisted with investigation and remediation, and Ascension said it notified law enforcement, government authorities and business partners.
Ascension ransomware timeline
| Date | What is established |
|---|---|
| May 7–8, 2024 | A later breach investigation identified unauthorized copying of certain files during this period. |
| May 8 | Ascension detected unusual activity and restricted affected technology systems. |
| May 9 | Ascension publicly acknowledged a cybersecurity event and clinical disruption. |
| May 10–13 | Ransomware was confirmed in contemporaneous reporting; hospitals reported outages, ambulance diversions and pauses or delays in some care. |
| May–June | Hospitals used manual and paper-based downtime procedures while systems were progressively restored. |
| June 14 | Ascension reported restoration of its electronic health record and patient portal across the system; information recorded during downtime still needed reconciliation. |
| June 20 | Healthcare Dive reported that EHR and clinical workflows were fully restored. |
| September | Ascension said May and June results reflected business interruption, remediation and related costs. |
| February 2025 | Ascension reported meaningful recovery in patient volumes and operating indicators. |
| December 2024 onward | Breach-notification letters described copied files containing personal information. |
Ransomware, outage and data breach are different facts
- Cybersecurity incident: Ascension’s initial description while the investigation was underway.
- Ransomware attack: The later-confirmed attack mechanism.
- Operational outage: Loss or interruption of access to clinical and administrative systems.
- Data breach: The later finding that a cybercriminal obtained copies of certain files containing personal information.
Operational downtime does not by itself prove that data was exfiltrated. Conversely, a breach notice does not prove that every unavailable system, or every patient’s full chart, was copied.
Recommended Free Tools
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How patient care was affected
The disruption was more than an inconvenience for staff trying to log in. Reports described effects across clinical, communication and pharmacy workflows. Healthcare Dive’s incident coverage documented the following consequences:
- Electronic health records were unavailable or impaired.
- MyChart and some telephone systems could not be used normally.
- Systems for ordering certain tests, procedures and medications were affected.
- Clinicians relied on paper records, manual processes, telephone calls, fax and other downtime methods.
- Some emergency departments diverted ambulances.
- Some elective procedures and nonurgent care were paused or delayed.
- Pharmacy operations were disrupted in multiple states; some patients were asked to pay cash or use another pharmacy.
Impact varied by hospital, state, pharmacy and service line. A functioning emergency department could still have longer waits, while a patient whose hospital was operating might nevertheless lose portal or prescription access.
Rank #2
- 【Versatile Storage Expansion – For Gaming, Work & Everyday Use】 Running out of space on your PS5 or Xbox Series X/S? This external hard drive lets you store and play PS4 / Xbox One games directly, instantly freeing up your console’s internal storage for next‑gen titles. At the same time, it handles work file backups, media libraries, and cross‑device data transfers with ease. One drive, all your needs. *（Note: PS5 / Xbox Series X|S games cannot be run or stored directly from the external hard drive. However, by offloading your PS4 / Xbox One games, you can free up valuable space for newer titles.）*
- 【Patented Silicone Sleeve – Data Protection You Can Count On】 Worried about drops? We’ve got you covered. The patented built‑in silicone sleeve acts like a shock‑absorbing armor, cushioning your drive against bumps and falls. Whether it’s important work documents, precious family photos, or hard‑earned game saves, your data deserves this level of protection.
- 【Plug & Play, Compatible with Computers & Consoles】 No complicated setup—just plug in and go. Works seamlessly with Windows, Mac, and Linux computers, as well as PS4, PS5, Xbox One, and Xbox Series X/S. Process files at the office, back up data at home, or enjoy gaming in your downtime—one drive handles all your devices, simply and hassle‑free.
- 【USB 3.0 Ultra‑Fast Transfer – No More Waiting】 Tired of watching progress bars crawl? With USB 3.0 speeds up to 5Gbps, large files transfer in seconds. Whether you’re moving work documents, transferring hundreds of gigs of games, or backing up a year’s worth of photos, you get more done in less time.
- 【Sleek, Lightweight, and Ready to Go】 Weighing just 0.16 kg—lighter than a can of soda—this compact drive features a stylish mirror‑and‑frosted finish. Toss it in your bag and go, whether you’re heading to the office, visiting a friend for a gaming session, or giving a presentation on the road.
How hospitals worked during downtime
When an EHR is unavailable, clinicians can use predefined downtime packets, paper medication-administration records, printed schedules, phone and fax communication, and manual order-entry queues. Patients may be asked to confirm medications, allergies, diagnoses and contact details from memory or from containers they bring. Once systems return, those records must be entered, checked and reconciled. Restoration therefore does not mean every piece of downtime documentation appeared instantly or without follow-up.
During a similar interruption, bringing a current medication list, prescription bottles, allergy information and a brief symptom history can reduce avoidable delay. Patients should follow facility instructions for urgent care rather than postponing emergency treatment because a portal is unavailable.
Rank #3
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
What information was involved?
In a breach-notification letter filed with South Carolina, Ascension said investigators found evidence that a cybercriminal obtained copies of certain files on May 7 and May 8, 2024. The letter says files contained an individual’s name and additional personal information. The exact categories and whether they applied to a particular person depend on that person’s notice; not every affected individual necessarily had every category. Read the complete Ascension breach-notification letter for the categories listed in your case.
Do not treat the notice as proof that all Ascension patients’ complete medical records were stolen. It establishes copied files involving some patients and associates, not universal exposure.
Rank #4
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
How many people were affected?
The precise total should come from the original regulatory filing or Ascension notice applicable to this incident. Avoid figures repeated by aggregators, litigation advertisements or unrelated databases unless the underlying filing is available and clearly identifies the May 2024 event.
The HHS Breach Portal is the federal database for reportable breaches, but an Ascension entry dated April 28, 2025, involving 437,329 people is a separate incident unless an original filing proves otherwise. Do not merge it with the 2024 ransomware event. See the HHS OCR Breach Portal and the HHS Breach Notification Rule for reporting context.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBest Value
- 【Plug-and-Play Expandability】 With no software to install, just plug it in and the drive is ready to use in Windows（For Mac，first format the drive and select the ExFat format.
- 【Fast Data Transfers 】The external hard drives with the USB 3.0 cable to provide super fast transfer speed. The theoretical read speed is as high as 110MB/s-133MB/s, and the write speed is as high as 103MB/s.
- 【High capacity in a small enclosure 】The small, lightweight design offers up to 500GB capacity, offering ample space for storing large files, multimedia content, and backups with ease. Weighing only 0.35 Lbs, it's easy to carry "
- 【Wide Compatibility】Supports PS4 5/xbox one/Windows/Linux/Mac and other operating systems, ensuring seamless integration with game consoles,various laptops and desktops .
- Important Notes for PS/Xbox Gaming Devices: You can play last-gen games (PS4 / Xbox One) directly from an external hard drive. However, to play current-gen games (PS5 / Xbox Series X|S), you must copy them to the console's internal SSD first. The external drive is great for keeping your library on hand, but it can't run the new games.
Where the applicable filing cannot be verified, the accurate statement is that Ascension notified affected individuals that personal information had been copied, while the precise incident total remains a matter for that filing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Ascension did in response
- Isolated or restricted affected systems after detecting unusual activity.
- Activated clinical and administrative downtime procedures.
- Engaged Mandiant for investigation and remediation.
- Notified law enforcement, relevant government authorities and business partners.
- Restored systems progressively, monitoring them before reconnecting workflows.
- Sent breach notifications after the investigation identified copied files involving personal information.
When were systems restored?
Ascension reported restoration of its EHR and patient portal across the system by June 14, 2024. Healthcare Dive’s state-by-state tracker reported full restoration of EHR and clinical workflows by June 20. Uploading and reconciling information created during downtime continued after restoration, so a restored login was not necessarily proof that every historical entry had already been reviewed.
Financial and operational recovery continued afterward. In its September 2024 results, Ascension said May and June revenue and expenses were affected by interruption, remediation and related costs. In February 2025, it reported same-facility patient-volume improvement of approximately 5%–6% since the event and said key operating indicators were moving toward normal. These are company-reported recovery measures, not an independent clinical-safety audit. Sources: Ascension FY24 results and Ascension Q2 FY25 results.
What patients and former employees should do
- Read the official letter and note exactly which information categories it lists.
- Use only the telephone number or website printed in that notice to ask whether a particular person was included.
- Review health-insurance Explanation of Benefits statements and watch for unfamiliar medical bills, prescriptions or claims.
- Change passwords reused for a patient portal, email or other accounts, and enable multifactor authentication where available.
- Treat unsolicited calls, texts and emails offering “breach help” as possible scams.
- If the notice lists Social Security or government-identification information, consult the Federal Trade Commission or your state attorney general about identity-theft steps.
These precautions reduce risk but cannot eliminate medical-identity fraud. Do not assume that every Ascension patient was notified, and do not assume that receiving a notice means every listed data type was exposed.
Quick Recap
What remains unknown
- The attacker’s identity and precise entry method have not been established in the cited sources.
- The sources do not establish whether Ascension paid a ransom.
- The exact volume of copied data and the final, incident-specific affected-person count require the applicable original filing.
- Operational disruption is documented, but patient-specific medication delays, documentation errors, delayed diagnoses, deaths or other clinical injuries require separate evidence and cannot be inferred from the outage alone.
- Restoration of systems does not establish that every patient record was restored without an error or delay.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
