UMMC ransomware closes 35 Mississippi clinics; personal and medical data exposure notices follow
Ransomware closed UMMC's 35 Mississippi clinics in February; normal operations resumed on 2 March. November notices warn of possible personal and medical data exposure. Check any notification and ask UMMC whether you are affected.
If you or a relative may be affected, call UMMC's incident line on +1 844 971 8617. Follow any notification letter, review financial and medical insurance statements, and consider a credit freeze; free credit monitoring is offered when a Social Security number was affected.
What’s happening
A ransomware attack discovered on 19 February disrupted the University of Mississippi Medical Center's computer systems and closed its 35 clinics across Mississippi. Staff lost access to Epic electronic medical records, and surgery, imaging and chemotherapy appointments were disrupted. Hospitals and emergency departments stayed open using downtime procedures. Urgent chemotherapy restarted on 23 February, and clinics resumed normal operations on 2 March. The privacy investigation continued: UMMC's November notice says potentially exposed information included identity documents, Social Security numbers, medical records, financial details and account credentials, with different information involved for different people. Notification letters began on 2 November. UMMC reports no evidence of misuse but gives no affected-person total. As at 3 November, whether a ransom was paid remains undisclosed; Medusa's reported claim of responsibility has not been confirmed by UMMC.
- What
- Breach
- Affects
- University of Mississippi Medical Center hospitals and clinics
- Fixed in
- Nothing to patch
- Since
- 11 Feb 2026
Timeline
- Update
UMMC began sending notification letters to potentially affected individuals with known addresses. It reported no evidence of data misuse and offered eligible people free credit monitoring.
- Update
UMMC determined that the affected systems contained personal and protected health information.
- Update
Mississippi Today reported that Medusa had claimed responsibility in March, but UMMC had not confirmed that attribution. UMMC had also not disclosed whether it paid a ransom.
- Update
UMMC confirmed its clinics had resumed normal operations. Hospitals and emergency departments had stayed open throughout the disruption.
- Update
UMMC restarted chemotherapy through an urgent infusion service operating offline, then increased patient numbers during the week.
- Update
Closures continued for a second day, disrupting chemotherapy as well as elective procedures. UMMC said it was contacting patients needing time-sensitive treatment; hospitals and emergency departments remained open.
- Made publicNothing to patch
Ransomware disrupted UMMC's systems, including access to Epic medical records, and forced its 35 Mississippi clinics to close. Outpatient surgery and imaging appointments were cancelled; hospitals continued using downtime procedures.
- Update
UMMC later identified 11–19 February as the period when affected systems may have been accessed or data taken.
Sources
- Notification of Data Security IncidentUniversity of Mississippi Medical Center · 2 Nov 2026
- ‘This has pulled us together’: UMMC prioritizes care, learning during cyberattackUniversity of Mississippi Medical Center · 2 Mar 2026
- Mississippi medical center closes all clinics after ransomware attackBleepingComputer · 20 Feb 2026
- Mississippi hospital system closes all clinics after ransomware attackAssociated Press · 20 Feb 2026
- Months after UMMC cyberattack, questions persist about patient data and systems improvementsMississippi Today · 23 Apr 2026