Black Basta was widely reported as the group behind Ascension’s May 2024 ransomware attack, but Ascension has not publicly confirmed that attribution. CNN, citing four sources briefed on the investigation, identified Black Basta on May 10, 2024. Ascension’s own later breach notification confirmed that the event was ransomware and that files had been copied, but did not name the attacker.
The attack disrupted electronic health records, patient portals, communications, test and medication ordering, and other clinical and administrative workflows across Ascension’s nationwide network. Ascension restored electronic-health-record access across the system by June 30, 2024. It later reported that 5,599,699 people were affected by the data breach, with notifications beginning December 19, 2024.
As an Amazon Associate I earn from qualifying purchases.
This is the current public picture as of August 10, 2026: the actor attribution remains reported rather than officially confirmed by Ascension; the final number of people listed in breach notices is known; ransom payment and the full attack chain remain unverified; and some reporting and legal consequences continued more than two years after the clinical systems came back online.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What happened at Ascension?
Ascension, one of the largest nonprofit healthcare systems in the United States, detected unusual activity on May 8, 2024 and began isolating affected systems. The organization publicly described the event on May 9 as a cybersecurity incident that was disrupting clinical operations. Its later individual notification described the incident as a ransomware attack.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Ascension said an employee unknowingly downloaded a malicious file believed to be legitimate. That is the organization’s publicly described initial foothold, not a complete forensic account of the intrusion. Public sources do not establish the file’s delivery method, the malware loader, how the attackers escalated privileges, how they moved through the network, or exactly how encryption was deployed.
Ascension brought in outside incident-response assistance, including Mandiant, and notified law enforcement and government partners. During the response, the health system took technology offline or isolated systems to contain the attack. That containment helped protect remaining systems, but also made normal clinical and administrative work unavailable at many locations.
On May 10, CNN reported that four sources briefed on the investigation identified Black Basta as responsible. The report was repeated by CRN and other outlets. Federal agencies also issued a Black Basta threat advisory that day. Those developments make the attribution substantial, but they do not turn it into an attribution publicly confirmed by Ascension.
What is confirmed—and what is only reported?
The most accurate description is: Black Basta was reportedly behind the Ascension attack. It is not accurate to say that Ascension publicly confirmed Black Basta as the perpetrator.
| Confidence level | What can safely be said |
|---|---|
| Officially confirmed by Ascension | Ascension detected a cybersecurity incident, later described it as ransomware, said files had been copied, and notified law enforcement and government partners. |
| Strongly reported | CNN, citing four sources briefed on the investigation, identified Black Basta. CRN and other reputable outlets reported the same attribution. |
| Not publicly verified | The precise forensic evidence tying the intrusion to Black Basta, the identity of any affiliate, the complete attack path, and whether Black Basta itself or an affiliate carried out each stage. |
The joint FBI, CISA, HHS and MS-ISAC advisory confirmed that Black Basta was an active ransomware threat affecting healthcare and other critical infrastructure. It did not publicly provide an Ascension-specific forensic report. Accordingly, the wording reported Black Basta operation is more precise than Ascension confirmed Black Basta attacked it.
Timeline of the Ascension attack and aftermath
| Date | Event |
|---|---|
| May 7–8, 2024 | Ascension’s later notification said a cybercriminal obtained copies of certain files during this period. |
| May 8, 2024 | Ascension detected unusual activity and began isolating systems. |
| May 9, 2024 | Ascension publicly described a cybersecurity event and warned that clinical operations were being disrupted. |
| May 10, 2024 | CNN, citing four sources, reported that Black Basta was responsible. Federal agencies simultaneously issued a Black Basta advisory. |
| Mid-May 2024 | Reports described ambulance diversions at some facilities, paper charting, unavailable EHR access, delayed workflows and temporarily paused elective procedures. |
| June 13, 2024 | Ascension disclosed that certain files had been exfiltrated and that some contained protected health information and personally identifiable information. |
| June 2024 | Ascension progressively restored EHR access in different markets. |
| June 30, 2024 | Ascension’s audited financial statements said EHR access had been restored across the system. |
| July 2024 | Ascension filed an interim breach report with HHS using an estimated figure of 500 affected individuals while its review continued. |
| December 19, 2024 | Ascension began notifying affected individuals. The final reported total was 5,599,699 people. |
| September 23, 2025 | A federal court allowed substantial portions of a proposed class action to proceed, while dismissing one Wisconsin statutory claim as an independent cause of action. |
| May 6, 2026 | Ascension said incomplete data caused by the 2024 attack continued to affect some quality and safety reporting and could affect certain Leapfrog ratings through calendar year 2027. |
Ascension’s initial incident statement is available on its website. Its audited financial statements provide the June 30 restoration milestone and additional information about revenue-cycle and cash-flow effects.
What is Black Basta?
Black Basta is a ransomware-as-a-service operation first identified in April 2022. In this model, a core criminal group typically develops or operates the ransomware infrastructure while affiliates help obtain access to victims and conduct intrusions.
Black Basta used a double-extortion model: attackers could steal data before encrypting systems, then threaten to publish the stolen information unless the victim paid. In its May 2024 advisory, federal agencies said Black Basta affiliates had affected more than 500 organizations globally and had targeted at least 12 of 16 critical-infrastructure sectors, including healthcare and public health.
The advisory described common Black Basta tactics such as spearphishing, exploitation of known vulnerabilities and abuse of valid credentials. It also listed tools and techniques associated with the operation, including PsExec, Remote Desktop Protocol, BITSAdmin, Cobalt Strike, credential theft and network scanning.
Those are general threat-profile findings. They are not proof that each tool or technique was used against Ascension. No public Ascension forensic report located for this article establishes the specific tools used in the May 2024 intrusion.
Black Basta has often been described as a Russia-linked or Russian-speaking cybercrime operation. That terminology should not be confused with proof of direct Russian government control or command.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How did the attackers reportedly get in?
Ascension said an employee unknowingly downloaded a malicious file that appeared legitimate. That disclosure supports describing the download as the reported initial foothold. It does not establish that the employee was personally responsible for the breach, nor does it reveal the entire intrusion.
Still unknown publicly are:
- Whether the file arrived through email, a messaging service, a website or another channel;
- The exact malware or loader involved;
- How the attackers obtained or elevated administrative privileges;
- How they moved laterally through Ascension’s environment;
- Which systems they encrypted or isolated;
- How the stolen files were selected and transferred; and
- Whether an affiliate, Black Basta’s core operators or another criminal actor performed each stage.
It would therefore be misleading to insert generic Black Basta techniques—such as Cobalt Strike, PsExec or QakBot—into the Ascension story without Ascension-specific evidence.
Which Ascension systems were affected?
The phrase brought down Ascension systems should be understood as a widespread interruption of network, clinical and administrative workflows—not as proof that every hospital and every application became completely inoperable.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Reportedly affected or unavailable systems and processes included:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Electronic health records and normal access to patient histories;
- Patient-facing portals, including MyChart;
- Some phone and communications services;
- Systems used to order laboratory tests, procedures and medications;
- Laboratory, surgical and medication-related workflows;
- Insurance verification, claims submission and payment processing;
- Some appointments, elective procedures and other scheduled care; and
- Data systems used for quality and safety reporting.
At the time of the incident, Ascension described a network of approximately 140 hospitals across 19 states and Washington, D.C. That was the organization’s historical 2024 footprint, not necessarily its current size after later organizational changes or divestitures.
Contemporaneous reporting said investigators found files containing PHI and PII on seven of approximately 25,000 servers. This figure concerns servers where affected files were found. It does not mean that only seven servers or seven applications were unavailable. In a distributed healthcare environment, isolating a relatively small number of file or identity systems can disrupt many dependent applications. That is a technical explanation of how the outage could be broad; it is not a disclosed Ascension finding about the exact dependency chain.
Associated Press coverage described the outage and operational response, including ambulance diversions and the use of paper records. CNN’s contemporaneous reporting also described clinical effects.
How did the attack affect patient care?
The operational effects varied by facility and market, but public reporting established several important consequences:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Some emergency departments diverted ambulances or asked first responders to use other hospitals.
- Staff used paper charts and other predefined downtime procedures.
- Clinicians lacked normal access to records, orders and communications.
- Some tests, procedures and appointments were delayed or postponed.
- Some elective procedures were temporarily paused.
- Insurance verification and claims work remained delayed after clinical access began returning.
Downtime procedures can allow a hospital to continue caring for patients, but they generally require later reconciliation of handwritten or manually recorded information. They can also create delays, duplicate work and communication problems when clinicians cannot use their normal systems. These are operational risks associated with the outage; they should not be presented as a quantified Ascension patient-safety finding.
The public record reviewed for this article does not establish an overall death toll, a specific number of medication errors or a verified number of injuries caused by the attack. Serious disruption is documented, but a specific incident-attributable patient-harm total should not be invented or inferred.
What data was stolen or exposed?
Ascension’s notification said a cybercriminal obtained copies of certain files on May 7 and May 8, 2024. The information involved varied by person. The notification did not say that every affected individual had every listed data element exposed.
Potentially involved information included:
- Name;
- Medical-record number;
- Dates of service;
- Types of laboratory tests;
- Procedure codes;
- Credit-card information;
- Bank-account information;
- Medicaid or Medicare identification numbers;
- Insurance policy numbers or insurance-claim information;
- Social Security number;
- Tax-identification number;
- Driver’s-license number;
- Passport number;
- Date of birth; and
- Address.
That means the incident involved more than clinical information. Depending on the individual, the copied data could also create risks involving medical identity theft, insurance fraud, account fraud or identity theft.
Free tools Windows power users keep installed
One-click scans. No signup required.
“Files were copied” supports saying that information was taken from Ascension’s environment. The public record does not establish which data fields belonged to each person, whether every copied file was later used, whether the data was publicly released, or whether the attackers deleted their copies.
How many people were affected?
The final reported figure is 5,599,699 people. That number appears in the Maine Attorney General’s breach record, and Ascension’s notification letter was filed with state regulators.
Ascension began consumer notifications on December 19, 2024. The figure is not properly described as 5.6 million patients in every context: the affected population included patients and associates, and the notice count is a number of people reported for breach-notification purposes. It should not be treated as a count of every unique patient treated by Ascension or as evidence that all individuals had the same information exposed.
Early figures were much smaller because the review was incomplete. In July 2024, Ascension used an interim HHS estimate of 500 affected individuals. That was not the final scope and should not be used in place of the later 5,599,699-person figure.
Recommended Free Tools
What did Ascension offer people who received a notice?
The December 2024 notification offered affected individuals:
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
- 24 months of credit and CyberScan monitoring;
- A $1 million insurance reimbursement policy; and
- Fully managed identity-theft recovery services through IDX.
The notice also recommended reviewing credit reports, watching bank and payment-card accounts, and remaining alert for suspicious communications. Those were the terms of the original notification. As of 2026, readers should not assume that the original enrollment window or monitoring benefit remains open; they should use the instructions in their own official notice or contact Ascension through a verified support channel.
What should an affected person do now?
If you received an Ascension breach notice, practical steps include:
- Verify the notice. Use the phone number, website and enrollment instructions printed in the official notice rather than links in an unexpected email or text.
- Check your credit reports. Look for unfamiliar accounts, inquiries, addresses or collection activity. You can obtain free reports through AnnualCreditReport.com, the federally authorized source.
- Consider a credit freeze or fraud alert. A freeze can make it harder for a thief to open new credit in your name. A fraud alert asks creditors to take additional steps to verify applications.
- Monitor financial and medical accounts. Review bank, payment-card, insurance and medical statements for transactions, claims or services you do not recognize.
- Be cautious about follow-up scams. Criminals may use a known breach to impersonate Ascension, an insurer, a credit bureau or a monitoring provider.
- Preserve documentation. Keep the notice and records of suspicious activity, time spent resolving fraud and documented expenses.
- Get individualized legal advice if needed. Receiving a notice alone does not establish eligibility for compensation. A qualified attorney can assess a particular person’s facts and applicable law.
A credit freeze is generally free and does not affect existing credit accounts, although it may require temporarily lifting the freeze when applying for new credit. A fraud alert is different from a freeze and may be more appropriate for some people. Neither option prevents all forms of medical or account fraud, so ongoing statement review remains important.
When were Ascension systems restored?
Recovery occurred in stages. Ascension reported phased EHR restoration in several markets in early June 2024 and anticipated broad restoration by June 14. Its audited FY2024 statements later said EHR access across the system had been restored by June 30, 2024.
That milestone did not mean every consequence ended on June 30. Ascension’s financial statements said the incident affected revenue-cycle processes and cash flows, including insurance verification, claims submission and payment processing. Claims work continued into a subsequent reporting period, and remediation costs affected operations.
Ascension’s 2025 financial reporting said the investigation and analysis were substantially complete and that notifications had been provided to affected individuals, regulators and state agencies. Yet in a May 2026 update, Ascension said incomplete datasets resulting from the 2024 cyberattack could affect certain Leapfrog hospital-safety ratings through calendar year 2027. That is an example of why restoring access to an EHR is not the same as fully restoring every downstream reporting, financial and regulatory process.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How much did the attack cost?
Ascension has publicly disclosed operational and financial effects, but the available audited statements do not isolate one verified total cost for the May 2024 ransomware attack.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The statements describe:
- Reduced revenue and delayed revenue-cycle activity;
- Delays in insurance verification, claims submission and payment processing;
- Remediation expenses;
- Negative effects on operations and cash flow during May and June 2024; and
- Claims-submission work that continued into a later reporting period.
Ascension’s overall financial results should not be labeled as the ransomware’s price tag. The organization’s financial statements describe multiple factors affecting its results and do not attribute its entire operating loss to this cyberattack. There is no verified public figure in the reviewed sources that represents the full incident cost.
The February 2024 third-party clearinghouse incident also should not be combined with the May ransomware attack. Ascension discussed that earlier event separately in its financial reporting because it affected claims, payments and insurance verification.
Did Ascension pay a ransom?
No publicly verified source located for this article establishes whether Ascension paid a ransom, how much attackers demanded, whether a payment was made, whether Ascension obtained a decryptor, or whether the attackers agreed not to publish the stolen data.
The absence of a public Black Basta leak-site listing does not prove that Ascension paid. Conversely, system restoration does not prove that it refused to pay. Both payment and nonpayment can produce ambiguous public outcomes, so no conclusion should be drawn from those facts alone.
What litigation followed?
A proposed federal class action followed the May 2024 breach. In a September 23, 2025 order, the court found that plaintiffs had plausibly alleged injuries including financial fraud, lost time and exposure of personal information. The court allowed substantial claims to proceed but dismissed one Wisconsin data-breach-notification claim as an independent cause of action, while allowing the statute to remain relevant to negligence claims.
That was a procedural ruling, not a final finding that Ascension was liable and not a determination that every proposed class member suffered compensable harm.
A separate docket concerns litigation associated with a December 2024 Ascension-related breach. It should not be confused with the May 2024 Black Basta incident.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
Why do the breach dates appear inconsistent?
Some state breach records list February 29, 2024 as the date the breach occurred. Ascension’s consumer notification, however, says a cybercriminal obtained copies of certain files on May 7 and May 8, 2024, and Ascension says it detected unusual activity on May 8.
The public record reviewed here does not explain the February 29 entry. It could reflect an administrative reporting field, an earlier date used for a broader incident window or a different interpretation of when unauthorized access began. The safest wording is:
Ascension detected the attack on May 8, 2024. Some state filings list February 29 as the breach date, but Ascension’s notification identifies May 7–8 as the period when files were obtained.
It would be unsupported to state that the attack began on February 29 unless Ascension or investigators later explain that date.
What remains unresolved?
Even after the notification process and system recovery, several central questions remain unanswered publicly:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Whether Black Basta was formally confirmed by Ascension or the FBI, rather than reported by sources briefed on the investigation;
- The identity of the affiliate, if any, that accessed Ascension;
- The complete intrusion path and the exact tools used;
- The ransom amount, whether a ransom was paid and whether a decryptor was obtained;
- Whether attackers retained, sold, published or deleted the copied data;
- Which specific individuals had which specific data elements copied;
- Whether any particular patient injury, medication error or death was caused by the outage; and
- The final all-in financial cost of the incident.
The public record supports a serious ransomware attack, a substantial data breach and major operational disruption. It does not support filling these gaps with assumptions.
The bottom line for patients, employees and financial teams
The Ascension incident was not simply a temporary website outage. Ransomware disrupted clinical technology, forced some facilities into downtime procedures, affected emergency transport and elective care, delayed revenue-cycle work and exposed information belonging to millions of people.
At the same time, precision matters. Black Basta is the reported attacker, not an actor publicly named by Ascension in the cited official notices. Seven servers containing affected files is not the same as seven total systems being disrupted. The 5,599,699 figure is a breach-notification count, not proof that every person had a complete medical record stolen. And restored EHR access did not end the financial, legal, data-reporting and identity-protection consequences.
For anyone notified, the most useful response is to follow the official notice instructions, monitor credit and financial accounts, consider a freeze or fraud alert, preserve evidence of suspicious activity and treat unexpected breach-related contacts with caution.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Frequently Asked Questions
Did Ascension confirm that Black Basta carried out the attack?
No. CNN, citing four sources briefed on the investigation, reported that Black Basta was responsible, and other outlets repeated the attribution. Ascension later confirmed that the event was ransomware and that files had been copied, but its cited official notices did not publicly name Black Basta.
How many people were affected by the Ascension breach?
The final reported figure was 5,599,699 people, according to the Maine Attorney General’s breach record. Notifications began on December 19, 2024. The number included patients and associates and does not mean every person had the same information exposed.
Did Ascension pay Black Basta?
There is no publicly verified source in the reviewed record establishing whether Ascension paid a ransom, the amount of any demand or whether attackers deleted the stolen data.
What should someone who received an Ascension notice do?
Use the official notice’s enrollment instructions, review credit reports, monitor bank, card, insurance and medical accounts, consider a credit freeze or fraud alert, beware of impersonation scams and preserve records of suspicious activity or expenses.
The Bottom Line
Bottom line: The evidence supports calling the May 2024 Ascension incident a ransomware attack that was reportedly conducted by Black Basta. Ascension confirmed file theft and ultimately reported 5,599,699 affected people, while EHR access was restored by June 30, 2024. The attacker attribution, ransom status, complete attack chain and attack-specific patient-harm total remain publicly unresolved as of August 10, 2026.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
