Coos County Family Health Services

Summary

A ransomware attack targeted Coos County Family Health Services, disrupting operations at its three clinics across Berlin and Gorham. The incident marked the second such attack against a North Country nonprofit organization within the same year, following a prior ransomware event affecting the Androscoggin Valley Regional Refuse Disposal District that resulted in an undisclosed ransom payment. Service interruptions occurred at the healthcare provider’s facilities due to the cyberattack.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 20, 2021, Coos County Family Health Services experienced a ransomware attack that disrupted operations at its three healthcare facilities in Berlin and Gorham, New Hampshire. The cyber incident marked the second ransomware attack targeting a Berlin-based nonprofit organization within six months, following a separate spring 2021 attack on the Androscoggin Valley Regional Refuse Disposal District. While technical details about the attack vector, specific ransomware variant, and initial intrusion methods remained undisclosed, the encryption of computer systems caused immediate service interruptions across the health provider's clinical locations. The organization, which operates two Berlin clinics and one Gorham facility, faced operational challenges stemming from the compromise of its digital infrastructure. No patient data compromise or theft was explicitly reported in available sources, with primary impacts centered on service delivery disruptions.

The attack occurred on a Monday, though the exact duration of system unavailability and full recovery timeline were not documented in public reports. Unlike the Androscoggin Valley District incident where officials confirmed paying an undisclosed ransom to recover encrypted files, no information indicated whether Coos County Health Services engaged with attackers or fulfilled ransom demands. The incident highlighted recurring cybersecurity vulnerabilities among North Country nonprofit organizations operating critical community services. Service restoration efforts proceeded without detailed public documentation of containment measures, forensic investigations, or third-party incident response involvement. Healthcare operations resumed following the attack, though the complete scope of affected systems and long-term financial or operational consequences remained unspecified in available records.

Sources

Sources available to members: 1 source.