Cyber Incident Victim: Brockton Hospital
Date:
Apr 2026
Location:
United States of America
Summary
Signature Healthcare diverted ambulances after a cyberattack caused significant disruption to its network, while inpatient and walk‑in emergency services remained open. The organization activated incident response protocols and moved to downtime procedures, leading to canceled chemotherapy infusion services and temporary closure of retail pharmacies that later reopened for consultations but could not fill prescriptions. Surgeries and procedures were not affected, and the organization has not confirmed a ransomware attack or identified the attackers’ motives.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Signature Healthcare, which operates Brockton Hospital, a 200‑bed community hospital in Brockton, Massachusetts, and the Signature Medical Group with more than 150 physicians across 15 locations, reported responding to a cybersecurity incident on Monday. Upon identifying suspicious activity within a portion of its network, the organization immediately activated its incident response protocols. As part of those protocols, Signature Healthcare moved to down‑time procedures to maintain patient care and safety. The down‑time measures included diverting ambulance traffic away from the hospital. Ambulance diversions continued into Tuesday, even though inpatient care and walk‑in emergency services remained open.
While surgeries and procedures were not affected by the incident, chemotherapy infusion services were canceled and patients were notified of potential delays at Signature Medical Group and urgent care practices. Some of the organization's retail pharmacies were closed on Monday. Those pharmacies reopened on Tuesday for consultations but were unable to fill prescriptions during that day. Patients receiving other outpatient services were advised to expect possible delays due to the cybersecurity response. The organization emphasized that its down‑time procedures were intended to preserve high‑quality care despite the disruption.
Signature Healthcare has not confirmed that the incident involved ransomware, and the attackers' motives remain unclear. No known ransomware group has claimed responsibility for the attack on the healthcare system. The statement noted that cybercrime groups often delay public attribution until negotiations stall or fail. The article also notes that many healthcare organizations worldwide have experienced disruptive cyberattacks in recent years, some of which have led to large‑scale data breaches and, in rare cases, patient harm. This context underscores the ongoing threat landscape facing health‑care providers.