Cass Regional Medical Center

Summary

Cass Regional Medical Center experienced a ransomware attack disrupting internal communications and electronic health records systems. The organization detected the incident and activated response protocols within 30 minutes, engaging cybersecurity experts and law enforcement while ensuring continued patient care. As a precaution, the EHR vendor disabled the system despite no evidence of data compromise. Leadership prioritized maintaining healthcare services and resolving the situation swiftly to restore normal operations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 10, 2018, Cass Regional Medical Center in Missouri publicly disclosed via Facebook that it had experienced a ransomware attack affecting critical operational systems. The organization detected anomalous activity at 11:00 AM local time, prompting immediate activation of its incident response protocol within 30 minutes of initial detection. The attack compromised the hospital's internal communications infrastructure and electronic health record (EHR) system, disrupting normal workflows. While no evidence indicated unauthorized access to patient data, the EHR vendor proactively took the system offline as a containment measure pending resolution. Hospital leadership convened patient care managers to develop contingency plans ensuring continued delivery of safe clinical services, while technical teams collaborated with cybersecurity experts and law enforcement agencies to investigate the incident.

The medical center maintained clinical operations through manual processes and alternative protocols during the outage. Senior executives prioritized minimizing patient care disruptions while working to restore systems, with CEO Chris Lang publicly emphasizing the institution's commitment to community healthcare services throughout the response. External cybersecurity consultants assisted in forensic analysis and recovery efforts, though the specific ransomware variant remained unidentified at the time of reporting. Cass Regional coordinated updates through its official website and social media channels, declining immediate media interviews while focusing on operational restoration. The incident highlighted persistent ransomware threats to healthcare infrastructure despite broader industry trends showing reduced attack frequency during that period.

Sources

Sources available to members: 1 source.