United Memorial Medical Center

Summary

United Memorial Medical Center experienced a ransomware attack during a period of heightened strain from COVID-19 operations, attributed to the Maze Team threat actors who listed the Houston medical center on their leak site following non-payment of demands. The attackers exfiltrated data including identifiable patient records, though only a limited sample was publicly released as proof of compromise. While the incident's operational impact remains unclear, there were no reported service disruptions or public alerts from the facility regarding care delays.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In late July 2020, United Memorial Medical Center (UMMC) in Houston experienced a ransomware attack while simultaneously managing severe COVID-19 patient surges. The Maze ransomware group claimed responsibility by listing UMMC on their data leak site around August 3, 2020, after allegedly breaching the hospital's systems. This occurred despite Maze's prior public declaration of a moratorium on attacking healthcare entities during the pandemic. The attackers followed their standard operational pattern by exfiltrating data before encryption and threatening to release it unless ransom demands were met. Evidence supporting their claim included a sample of stolen files posted online, which contained general hospital documents and one folder with identifiable patient health records. Independent verification confirmed the authenticity of these patient records through cross-referencing names with Houston-area residents. Maze did not disclose the ransom amount or specify whether the attack involved collaboration with other cybercriminal groups.

The hospital faced significant operational challenges during this period, including record COVID-19 fatalities and extreme weather conditions, which complicated incident response efforts. Maze's data leak site entry remained active, strongly suggesting UMMC did not pay the ransom. No public statements from the hospital acknowledged the cyberattack, and no service disruption notices appeared on their official channels. Local media did not report any treatment delays or system outages at the facility. The limited volume of leaked sample files (approximately 5% of the total exfiltrated data according to Maze's claim) indicated a relatively small data compromise compared to typical ransomware incidents. Critical questions regarding encryption impact on medical systems, data restoration methods, and potential care delivery consequences remained unanswered due to UMMC's lack of public communication about the event.

Sources

Sources available to members: 1 source.