Back to threat feeds
UMC
UMMC Ransomware Attack Shuts Clinics Across Mississippi
Ransomware attack on UMMC forces statewide clinic closures, cancels surgeries, and disrupts hospital systems across Mississippi.
Continue reading
Ransomware attack on UMMC forces statewide clinic closures, cancels surgeries, and disrupts hospital systems across Mississippi.
Continue reading
University of Mississippi Medical Center reported a ransomware-driven cyberattack that forced it to take major systems offline and close all clinic locations statewide. Outpatient and ambulatory surgeries and imaging appointments were canceled and many elective procedures were postponed while the facility reverted to downtime processes to continue urgent care.
UMMC first disclosed that many of its IT systems were down on the morning of February 19, 2026. Within hours the medical center announced closure of all clinic locations statewide and the cancellation or rescheduling of appointments and elective procedures. Emergency services and time-sensitive clinical care continued under manual, paper-driven procedures and contingency protocols. Hospital websites and patient-facing status pages were also offline during the incident. Federal agencies including the FBI, CISA, and DHS were notified and engaged in the response.
UMMC is a large, distributed health system. Public reporting notes that the center operates multiple hospitals, dozens of clinics, and hundreds of telehealth sites across Mississippi — meaning the outage created broad, cascading effects across clinical scheduling, diagnostic imaging, lab systems, and patient communications. That scale is why the organization described the disruption as potentially lasting multiple days while investigators and responders work to contain the incident.
Reporting to date establishes a few key technical and operational facts. First, UMMC’s electronic medical record (EMR) access was affected, forcing clinicians to use downtime procedures to document care. Second, hospital leadership confirmed that the attackers had contacted UMMC after the intrusion; investigators including the FBI were involved. Third, UMMC believes the impactlimited to local servers, while some systems and cloud-hosted data may be unaffected; the organization and its federal partners were assessing the scope and possible data exposure. Those are the most concrete, attributable facts available publicly at the time of writing.
Public articles do not yet identify the specific ransomware family, initial access vector, or exploit used. In this environment, however, several attack patterns commonly lead to the operational picture UMMC reported:
While these hypotheses are technically plausible given the symptoms, they remain hypotheses until forensic analysis and threat intelligence attribution are published by UMMC or federal partners.
When a large medical center loses electronic systems, three risk categories become critical.
First, patient safety. Manual procedures can safely carry care for urgent and trauma patients, but they increase the risk of documentation gaps, medication and allergy errors, and diagnostic delays. UMMC indicated Level I trauma and other urgent services continued using downtime procedures, which is the appropriate operational posture for such incidents.
Second, protected health information (PHI). When systems are taken offline to prevent breach, the question becomes whether data was exfiltrated prior to containment. UMMC said it was assessing potential impacts to patient information. If data were taken, that raises exposure risk for patients and triggers mandatory breach-notification processes under applicable regulations.
Third, systemic service impact. With clinics closed and appointments canceled, the backlog of care (rescheduled imaging, postponed elective surgeries) will create operational strain for days to weeks depending on restoration speed and backlog management.
UMMC activated its emergency operations plan, took affected systems offline to limit further compromise, and shifted to paper-based documentation to continue time-sensitive care. The FBI confirmed it had investigators working the incident and federal cybersecurity agencies were coordinating resources. Hospital leadership stated they were in contact with the attackers and working with law enforcement and forensic specialists on next steps. Public messaging emphasized patient safety while the organization and partners evaluated the scope and recovery path.
Healthcare organizations can, and should, follow a tightly sequenced recovery and reinforcement plan. Below I list practical measures derivative of CISA, HHS, FBI, and vendor best practices — appropriate for immediate containment, triage, and medium-term hardening.
Containment and triage: isolate infected segments and disconnect impacted local servers from the broader network. Prioritize restoration of systems that support lifesaving care and diagnostics, while preserving forensic evidence for investigators.
Forensic investigation: preserve volatile logs, collect endpoint and network telemetry, and engage experienced incident response teams. Coordinate with law enforcement to ensure evidence collection does not hinder prosecution.
Recovery and continuity: use clean backups to restore systems where possible. Validate backup integrity before restoration to avoid reintroducing the threat. Restore EMR read-only access early if feasible so clinicians can safely review records while full write capability is reestablished.
Access control and credentials: enforce multifactor authentication across remote access, privileged accounts, and administrative interfaces. Rotate credentials for service accounts and remove unnecessary administrative privileges.
Network architecture: segment networks so critical clinical systems and medical devices are isolated from standard user and administrative zones. Limit lateral movement by removing SMB access where not required, applying least privilege to share access, and enabling strict firewall rules.
Endpoint and detection: deploy modern endpoint detection and response (EDR) and ensure logging/monitoring cover lateral movement indicators. Tune detections for ransomware behaviour (rapid file modification, suspicious PowerShell/WMIC activity, anomalous remote logins).
Patch and configuration management: accelerate remediation for known exploited vulnerabilities (for example, patching remote-support tools and critical internet-exposed services). Maintain an inventory of assets and prioritize patching by exposure and criticality.
Communication and regulatory steps: notify affected patients per legal requirements if PHI was exposed. Maintain transparent, frequent communication with patients, staff, and partner facilities about service impact and expected timelines for rescheduling.
Patients should assume appointments canceled during the outage will be rescheduled and should expect outreach from the health system. If you have urgent or life-threatening conditions, follow local emergency guidance; UMMC reported emergency care remained available. Clinicians should document care thoroughly in paper charts when electronic systems are unavailable, use standardized downtime forms where provided, and conserve critical orders that require electronic resources until validated restoration. Patients wondering whether their data were exposed should wait for official notifications from the health system; in the meantime, they should monitor financial and identity accounts for suspicious activity.
This is not an isolated problem. Ransomware continues to be one of the most consequential threats to healthcare, frequently causing hospitals to operate manually, postpone care, and face potential patient-data exposure. Recent federal guidance and growing enforcement signals underscore the need for systemic investments in resiliency: asset visibility, rapid detection, segmentation, reliable off-site backups, and continuous tabletop exercises that include clinicians and operational leadership. For large, distributed networks like UMMC, the challenge is both technical and organizational — restoring operations safely while preserving forensic data and managing public trust.
UMMC’s ransomware incident is a high-impact event because of the system’s size and the clinical services it provides statewide. The immediate priority is patient safety and containment; the next phase will be forensics, restoration from trusted backups, and long-term hardening to reduce recurrence. For health systems and their partners, this incident is another reminder that cyber resilience in healthcare is not optional. It is core to patient safety, privacy, and the uninterrupted delivery of care.
148 malicious npm packages masquerading as student proxy and school Wi-Fi bypass tools. Rather than compromising developers during installation
