Ascension detected unusual activity on May 8, 2024, and disconnected or restricted access to selected technology systems while investigating. The organization later confirmed the incident was ransomware. Hospitals continued operating, but electronic health records, ordering, communications, patient portals and administrative workflows were disrupted. A later breach notification reported that data belonging to approximately 5.6 million people had been compromised.
What happened at Ascension?
Ascension initially described the event as a cybersecurity incident. It later confirmed that the disruption was caused by ransomware and said it engaged Mandiant, law enforcement and government partners to investigate and remediate the attack. The organization’s May 2024 update said some systems had been taken offline or made inaccessible as part of the response.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters. Ascension did not close its entire hospital network. Its hospitals continued providing care, but many teams had to use paper records and other manual downtime procedures while technology systems were investigated and restored.
Free tools Windows power users keep installed
One-click scans. No signup required.
At the time, Ascension operated approximately 140 hospitals in 19 states and Washington, D.C. The impact was not identical at every location or across every application. Some facilities experienced more serious disruption than others.
#1 Best Overall
Ascension cyberattack timeline
| Date | What happened |
|---|---|
| May 8, 2024 | Ascension detected unusual activity and restricted access to selected technology systems. |
| May 9, 2024 | The organization publicly described a cybersecurity event affecting clinical operations. |
| May 13, 2024 | Public reporting said Ascension had confirmed the event was ransomware. Patient portals, communications and other systems remained disrupted. |
| June 5, 2024 | Ascension reported that electronic health-record access had been restored in Florida, Alabama, Austin, Tennessee and Maryland, with broader restoration targeted for the week ending June 14. |
| June 14, 2024 | Ascension announced restoration of its electronic health-record systems. Vendors then began reconnecting services after security reviews. |
| December 2024 | A later breach notification reported that approximately 5,599,699 individuals were affected. |
Restoring the EHR did not necessarily mean that every interface, claim, prescription, vendor connection, backlog or forensic question had been resolved. Technical restoration and full operational recovery are separate milestones.
Which systems and services were affected?
The disruption affected more than a single hospital application. Reported consequences included:
- Electronic health records: Clinicians temporarily lacked normal access to patient histories, medication information, allergies, notes and other records.
- Orders and results: Workflows for ordering tests, procedures and medications were disrupted, while laboratory and imaging results could be delayed or harder to route.
- Patient portals: MyChart access was reported as unavailable during the early disruption.
- Telephones and communications: Some phone systems and internal communications were affected.
- Pharmacy services: Ascension Rx operations were progressively restored during recovery.
- Scheduling and referrals: Appointment booking, referrals and care coordination became more difficult.
- Revenue-cycle operations: Claims, billing and payment processes accumulated work and backlogs.
- External connections: Vendors and business partners had to disconnect, assess their own exposure and reconnect only after security review.
A R1 regulatory filing described manual procedures, vendor disconnection and effects on claims and revenue-cycle activities. This illustrates why an EHR outage can continue creating administrative consequences even after clinicians regain access to core records.
Recommended Free Tools
How did the outage affect patients?
Some emergency medical services were diverted to other hospitals, and some patients experienced postponed or delayed tests and appointments. Clinicians used paper and other manual processes to document care, prescribe medicines and communicate information.
Manual downtime procedures allow a hospital to keep operating, but they are slower and more error-prone than integrated digital workflows. Records may be incomplete, duplicated or difficult to read. Medication orders and allergy information may require additional verification. Laboratory or imaging results can be delayed or misrouted, and information recorded on paper must later be reconciled into the EHR.
Contemporary reporting described operational errors and delays, but those reports should not be treated as proof that the attack directly caused a particular patient injury unless a documented investigation establishes that connection. Ascension said its care teams were trained to operate during technology disruptions and that patient safety remained the priority.
For patients, an unavailable portal does not necessarily mean that a medical record was deleted. It may mean that the portal or its connection to other systems was temporarily disabled. Patients dealing with a delayed prescription, appointment or record request should contact the relevant facility through an official Ascension channel rather than relying on an unexpected text, email or phone call.
Why would a hospital take systems offline?
Disconnecting systems is a containment measure. If attackers are moving through a network or encrypting files, isolating affected systems can limit lateral movement and prevent additional damage. It can also give investigators time to determine which devices, accounts and applications are safe to reconnect.
Rank #3
The trade-off is especially severe in healthcare. Security teams are trying to protect confidentiality and prevent further compromise, while clinical teams need immediate access to accurate, available information. Taking systems offline can therefore turn a cyber incident into a clinical-availability crisis.
The main risks include:
- delayed access to medication histories, allergies and prior treatment;
- slower admissions, transfers, discharges and emergency-department workflows;
- delayed laboratory and imaging orders or results;
- duplicate or incomplete documentation when paper records are later entered into the EHR;
- staff turning to unauthorized spreadsheets, messaging apps or personal devices as workarounds;
- continued disruption when vendors, pharmacies or other connected services remain offline; and
- premature reconnection that allows malware to return.
Effective recovery therefore requires more than restoring servers. Organizations need clean backups, tested clinical downtime procedures, identity controls, segmented networks and a staged reconnection plan. Microsoft’s ransomware guidance emphasizes recovery planning and tested backups before an attack occurs.
Was patient data stolen?
Yes, according to the later breach notification. The U.S. Department of Health and Human Services breach portal reported approximately 5,599,699 affected individuals. The disclosure came months after the initial outage, so the size of the breach was not known from Ascension’s first May statements.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Reportedly exposed information included personal and health-related information. Secondary reporting also described payment information and government-identification data, but the definitive list of information types should come from the applicable official breach notice or state filing rather than from general news summaries.
Ascension reportedly offered affected individuals 24 months of identity-theft protection and monitoring, including an insurance component. The terms of any assistance are notice-specific and may change over time. Anyone receiving a breach letter should use the contact details in the official notice, verify them independently through Ascension’s website and avoid clicking links in unexpected messages.
Was the attack linked to Black Basta?
Later reporting linked the attack to the Black Basta ransomware operation. That attribution should be understood as reported attribution, not as a definitive government finding unless supported by a primary authority. The central fact does not depend on the group name: Ascension confirmed that ransomware disrupted its environment and the later breach notification established that information had been compromised.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What did the incident cost?
The attack disrupted billing, claims and other revenue-cycle processes and created costs for investigation, remediation, recovery and delayed work.
R1 estimated that two major 2024 healthcare cyber incidents discussed in its filing affected its own revenue by approximately $22.6 million during the first nine months of 2024. That figure was R1’s impact, not Ascension’s total loss.
Best Value
Ascension separately reported a $1.1 billion net loss for fiscal 2024. It would be misleading to attribute the entire loss to the cyberattack because the financial result included broader operating and nonoperating factors. Ascension’s fiscal 2024 results should be read in that broader context.
What patients should do
- Use official Ascension contact information for questions about appointments, prescriptions, records or breach assistance.
- Treat unexpected breach-related calls, texts and emails as possible phishing attempts.
- Monitor health-insurance statements, bank accounts, credit reports and medical accounts for unfamiliar activity.
- Consider a fraud alert or credit freeze if the official notice says identity information was exposed.
- Keep the official breach notice and document suspected identity theft or fraudulent medical activity.
- Ask the treating facility or clinician how to obtain records or manage a delayed prescription if a system or portal is unavailable.
The outage described here is historical. Current portal access, monitoring enrollment, patient-support options and any legal or regulatory developments should be confirmed on current official Ascension or government pages rather than inferred from the 2024 outage notices.
Lessons for healthcare organizations
The Ascension incident shows why ransomware resilience cannot be reduced to antivirus software or cloud backup. A healthcare organization needs coordinated controls across technology, clinical operations and third-party relationships.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Segment critical systems: Separate clinical, administrative, backup and identity environments so that one compromised account cannot reach everything.
- Protect privileged access: Use phishing-resistant multifactor authentication, tightly controlled administrator accounts and continuous monitoring.
- Maintain resilient backups: Keep offline or immutable copies and test restoration, not merely backup completion.
- Practice clinical downtime: Train staff on paper documentation, medication verification, lab and imaging workflows, reconciliation and escalation.
- Plan for vendor dependencies: Establish procedures for disconnecting, assessing and safely reconnecting pharmacies, laboratories, billing partners and other business associates.
- Define recovery targets: Set recovery-time and recovery-point objectives for the EHR, pharmacy, laboratory, imaging, communications and revenue-cycle systems.
- Communicate clearly: Give patients and employees reliable updates without overstating what is known about data exposure or recovery.
The broader lesson is that ransomware can affect three security objectives at once: availability of systems needed for care, integrity of clinical information and confidentiality of patient data. Restoring access addresses only part of the problem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
