Cyberattack Disrupts Services at 2 Massachusetts Hospitals

A North Central Massachusetts nonprofit healthcare system with two community hospitals, a medical group and several other care facilities has taken its IT network offline and is diverting ambulance patients as it continues to respond to a cyberattack that hit last week.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

Heywood Healthcare said it is continuing to care for inpatients at its 134-bed Heywood Hospital in Gardner, Massachusetts and its 25-bed critical access community hospital, Athol Hospital, in nearby Athol. But the hospitals are not accepting emergency care patients transported by ambulance. Radiology and laboratory services are also affected.

Local ambulance service, Central Massachusetts Emergency Medical Systems Corp. in Holden, Massachusetts on its Facebook page advised the community over the weekend that because Heywood and Athol hospitals CAT scan imaging services “will be down until further notice,” ambulances should transport stroke patients “to the next nearest primary stroke service hospital per state primary stroke service list.”

Email and phones are also affected, a Heywood Hospital worker told Information Security Media Group.

“Heywood Hospital recently experienced a network outage that has since been determined to be the result of a cybersecurity incident,” a Heywood Hospital spokesperson told Information Security Media Group in a statement.

“Upon discovery, we immediately activated our incident response protocols and took the affected systems offline to protect our network and patients. We are working closely with third-party cybersecurity experts to conduct an investigation into the nature and scope of the incident and are in contact with law enforcement,” the spokesperson said. The investigation “is early and ongoing,” she said.

“At this time, we are not accepting ambulance emergency services and are limited in our radiology and lab services. Our outpatient provider offices, perioperative and inpatient units remain operational.”

Heywood Hospital did not immediately respond to ISMG’s request for additional details, including the full extent of IT systems affected, whether ransomware encryption or data exfiltration was involved, whether the attacker demanded an extortion payment and the extent to which the health system has resorted to using manual and paper processes.

Patients of Heywood Medical Group are being instructed to reach out with questions about appointments through the medical practice’s patient portal. “If you are unable to access the Athena portal, the answering service is open and will deliver messages to your provider,” Heywood Hospital said in a post on its Facebook page.

Top Targets

Disruptive attacks on hospitals have become more commonplace with cybercrime groups targeting them with ransomware. The healthcare industry – as well as local government and manufacturing – are the top targets of cyber attackers, “and will continue to be so because of their criticality and inability to operate when disrupted,” said Mike Hamilton, field CISO at security firm Lumifi Cyber.

In fact, a recent study by the Poneman Institute and security firm Proofpoint found that 93% of organizations experienced a cyberattack in the past 12 months and that 72% of healthcare organizations reported patient care disruptions due to the attacks.

The mission of healthcare organizations such as hospitals is to deliver patient care, making these organizations “most likely to pay extortion demands to return to operability,” Hamilton said. “This cycle continues to create a perverse incentive for cybercrime targeting covered entities.”

Researcher Christiaan Beek of security firm Rapid7 offers a similar assessment. “Hospitals and the healthcare sector as a whole are increasingly targeted as ethical boundaries have given way to a profit-centric mentality,” he said.

“With so many groups out there, everyone’s just looking to make a buck, and the social norms – even among threat actors – that once protected the industry have clearly gone out the window.”

The impact of cyberattacks on hospitals continues to be significant, often leading to prolonged operational disruptions and direct risks to patient care, said Dave Bailey, vice president of consulting services at healthcare privacy and security consultancy Clearwater.

“While many healthcare organizations are taking meaningful steps to strengthen their security posture and reduce exposure, the sector is still struggling to keep pace with the escalating threat landscape,” he said.

“True resilience remains a distant goal that will require sustained investment, modernization and a cultural shift toward proactive cybersecurity.”

Ransomware continues to dominate the threat landscape, but tactics have evolved – with double and triple extortion schemes, shorter dwell times and far greater operational disruption, Bailey said. Artificial intelligence-driven spear-phishing is making “fraudulent communications almost indistinguishable from legitimate ones,” Bailey said.

“Meanwhile, supply-chain compromises continue to ripple through healthcare ecosystems, and data-for-extortion campaigns are rising as attackers forgo encryption altogether, focusing instead on stealing patient data for leverage or resale,” Bailey said.

Beyond ransomware, attackers are increasingly exploiting vulnerabilities in security appliances such as VPNs, firewalls and edge devices to gain initial access, Beek said.

A critical concern is the escalating supply chain risk, he said. “Given healthcare’s heavy reliance on external vendors for billing, imaging and data management, such breaches underscore the urgent need to vet third-party security practices, limit vendor access privileges and monitor for data exfiltration beyond internal systems,” he said.

“Even well-secured hospitals are vulnerable if their partners’ security measures are inadequate.”

Taking Action

Hamilton recommends that healthcare organizations, including hospitals, take several critical measures to improve their security posture and resiliency as they face potentially disruptive cyber incidents such as ransomware and other attacks.

“Realize that the three prevalent methods for initial access are social engineering, vulnerability exploit and credential abuse and take steps to mitigate those methods,” he said. “Train users, move personal use to personal devices, use good credential management and multifactor authentication, and treat vulnerability patching with the same urgency as an incident when a patch is released for internet-facing products or those critical to patient care.”

Bailey suggests healthcare organizations develop deeper visibility into their risk landscape through the help of comprehensive and continuous risk analysis.

“As they strengthen the foundational pillars of security – protection, detection and response – they should also advance toward zero trust architectures, AI-driven behavioral monitoring and routine resilience exercises that validate the effectiveness of their defenses and investments.”

Anna Quinn, a security tester and researcher at Rapid7, said that based on what her organization is seeing from security testing perspective, she recommends healthcare entities also carefully implement segmentation.

“Ensure strong segmentation of all care-providing devices and systems to prevent cyberthreats to those devices as well as to ensure that patient care is not interrupted in the event of an attack,” she said.

Also, she suggests implementing similar protections around any uninterruptible power supply devices “to ensure attackers cannot cause power outages to critical systems through access to your power sources.”