Healthcare network diverts ambulances after ransomware hits scheduling systems
A multi-site healthcare provider took clinical systems offline following a ransomware intrusion, reverting to paper workflows and diverting emergency traffic while it rebuilds from backups.
The operational impact (ambulance diversion) lands before the data-leak threat does. Tabletop the 'EHR is down for 72 hours' scenario now — not the day the note appears.
The provider confirmed encryption of several internal systems and a switch to downtime procedures. No ransom group has been publicly attributed yet.
Backups appear viable, but restoration of clinical systems is measured in days, during which patient care reverts to manual processes.
Healthcare remains a soft target because uptime pressure makes paying or rushing recovery tempting. The defensive win is rehearsed, segmented recovery — not just having backups, but having practiced restoring them under time pressure.