{"id":"ummc-ransomware-clinic-closures-feb-2026","category":"breach","status":"live","title":"UMMC ransomware closes 35 Mississippi clinics; personal and medical data exposure notices follow","tldr":"Ransomware closed UMMC's 35 Mississippi clinics in February; normal operations resumed on 2 March. November notices warn of possible personal and medical data exposure. Check any notification and ask UMMC whether you are affected.","summary":"A ransomware attack discovered on 19 February disrupted the University of Mississippi Medical Center's computer systems and closed its 35 clinics across Mississippi. Staff lost access to Epic electronic medical records, and surgery, imaging and chemotherapy appointments were disrupted. Hospitals and emergency departments stayed open using downtime procedures. Urgent chemotherapy restarted on 23 February, and clinics resumed normal operations on 2 March. The privacy investigation continued: UMMC's November notice says potentially exposed information included identity documents, Social Security numbers, medical records, financial details and account credentials, with different information involved for different people. Notification letters began on 2 November. UMMC reports no evidence of misuse but gives no affected-person total. As at 3 November, whether a ransom was paid remains undisclosed; Medusa's reported claim of responsibility has not been confirmed by UMMC.","action":"If you or a relative may be affected, call UMMC's incident line on +1 844 971 8617. Follow any notification letter, review financial and medical insurance statements, and consider a credit freeze; free credit monitoring is offered when a Social Security number was affected.","product":"University of Mississippi Medical Center hospitals and clinics","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["ummc","ransomware","healthcare","data-breach","mississippi"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Notification of Data Security Incident","url":"https://www.umc.edu/Information-Security-Privacy/notices/Notification-of-Data-Security-Incident.html","by":"University of Mississippi Medical Center","date":"2026-11-02"},{"kind":"post","title":"‘This has pulled us together’: UMMC prioritizes care, learning during cyberattack","url":"https://umc.edu/news/News_Articles/2026/03/Cyberattack.html","by":"University of Mississippi Medical Center","date":"2026-03-02"},{"kind":"news","title":"Mississippi medical center closes all clinics after ransomware attack","url":"https://www.bleepingcomputer.com/news/security/university-of-mississippi-medical-center-closes-clinics-after-ransomware-attack/","by":"BleepingComputer","date":"2026-02-20"},{"kind":"news","title":"Mississippi hospital system closes all clinics after ransomware attack","url":"https://apnews.com/article/cyberattack-university-mississippi-clinics-hospital-4b27a578a5e095c5a7d25c90768a5312","by":"Associated Press","date":"2026-02-20"},{"kind":"news","title":"Months after UMMC cyberattack, questions persist about patient data and systems improvements","url":"https://mississippitoday.org/2026/04/23/ummc-cyberattack-patient-data/","by":"Mississippi Today","date":"2026-04-23"}],"started":"2026-02-11","closed":null,"created":"2026-11-03T20:43:14.057Z","updated":"2026-11-03T20:43:14.057Z","cve_notes":[],"timeline":[{"at":"2026-11-02","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"UMMC began sending notification letters to potentially affected individuals with known addresses. It reported no evidence of data misuse and offered eligible people free credit monitoring.","url":"https://www.umc.edu/Information-Security-Privacy/notices/Notification-of-Data-Security-Incident.html","by":"University of Mississippi Medical Center","patch":null},{"at":"2026-10-20","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"UMMC determined that the affected systems contained personal and protected health information.","url":"https://www.umc.edu/Information-Security-Privacy/notices/Notification-of-Data-Security-Incident.html","by":"University of Mississippi Medical Center","patch":null},{"at":"2026-04-23","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Mississippi Today reported that Medusa had claimed responsibility in March, but UMMC had not confirmed that attribution. UMMC had also not disclosed whether it paid a ransom.","url":"https://mississippitoday.org/2026/04/23/ummc-cyberattack-patient-data/","by":"Mississippi Today","patch":null},{"at":"2026-03-02","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"UMMC confirmed its clinics had resumed normal operations. Hospitals and emergency departments had stayed open throughout the disruption.","url":"https://umc.edu/news/News_Articles/2026/03/Cyberattack.html","by":"University of Mississippi Medical Center","patch":null},{"at":"2026-02-23","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"UMMC restarted chemotherapy through an urgent infusion service operating offline, then increased patient numbers during the week.","url":"https://umc.edu/news/News_Articles/2026/03/Cyberattack.html","by":"University of Mississippi Medical Center","patch":null},{"at":"2026-02-20","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Closures continued for a second day, disrupting chemotherapy as well as elective procedures. UMMC said it was contacting patients needing time-sensitive treatment; hospitals and emergency departments remained open.","url":"https://apnews.com/article/cyberattack-university-mississippi-clinics-hospital-4b27a578a5e095c5a7d25c90768a5312","by":"Associated Press","patch":null},{"at":"2026-02-19","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Ransomware disrupted UMMC's systems, including access to Epic medical records, and forced its 35 Mississippi clinics to close. Outpatient surgery and imaging appointments were cancelled; hospitals continued using downtime procedures.","url":"https://www.bleepingcomputer.com/news/security/university-of-mississippi-medical-center-closes-clinics-after-ransomware-attack/","by":"BleepingComputer","patch":"na"},{"at":"2026-02-11","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"UMMC later identified 11–19 February as the period when affected systems may have been accessed or data taken.","url":"https://www.umc.edu/Information-Security-Privacy/notices/Notification-of-Data-Security-Incident.html","by":"University of Mississippi Medical Center","patch":null}],"url":"https://hard.fyi/live/ummc-ransomware-clinic-closures-feb-2026/","json":"https://hard.fyi/api/live?id=ummc-ransomware-clinic-closures-feb-2026"}