Cyber Incident Victim: Crisp Regional Health Services
Date:
Jan 2021
Location:
United States of America
Summary
Crisp Regional Health Services experienced a ransomware attack that compromised some systems and encrypted files, discovered when nurses observed active file encryption. Despite the disruption, hospital officials confirmed that clinical workflows and patient care remained unaffected throughout the incident, with no operational compromises reported. The organization's response team addressed the attack promptly upon detection, maintaining continuity of critical healthcare services.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Crisp Regional Health Services experienced a ransomware attack on or around January 27, 2021, with the intrusion becoming apparent on Wednesday morning when nursing staff observed active file encryption across hospital systems. The attack compromised portions of the healthcare provider's digital infrastructure, leading to the encryption of files and disruption of certain operational systems. Hospital officials initiated an immediate response upon detection, though specific technical containment measures were not publicly detailed. Brooke Marshall, Community Relations and Foundation Director, emphasized that core clinical operations remained unaffected, stating that neither patient care delivery nor critical workflows were interrupted during or after the incident. The organization's public communications did not specify which departments or systems sustained primary impact beyond the generalized file encryption observed by clinical staff.
Crisp Regional confirmed the ransomware event through an official public release shortly after discovery, though they did not disclose whether data exfiltration occurred or identify the ransomware variant involved. Internal investigations commenced to assess the full scope of compromised systems and operational consequences. No evidence suggested unauthorized access to electronic health records or clinical management platforms based on available statements. The hospital maintained continuity of medical services throughout the incident without resorting to diversion of emergency cases or suspension of scheduled procedures. Marshall's assurances focused on the preservation of care standards while acknowledging the disruption caused by encrypted non-clinical files. Recovery efforts proceeded with no further public updates regarding system restoration timelines or potential data exposure.