A devastating cyberattack using ransomware hit the University of Mississippi Medical Center Thursday morning, bringing down its IT network and forcing the university to temporarily close its clinics and cancel appointments and surgeries all over the state due to the outage.
LouAnn Woodward, vice chancellor for health affairs and dean of the School of Medicine, confirmed the cause of the attack to the Mississippi Free Press at a press event. Countless systems statewide remain down, with clinical operations across dozens of clinics cancelled until further notice.
“Early this morning, we sustained a cyber attack, which impacted our IT network and many of our systems, including our electronic medical records system, EPIC. We have triggered our emergency operations plan: this impacts all medical center locations,” Woodward said.
Emergency services are still available at UMMC, with downtime protocols in effect. Shortly before press time, an update from UMMC confirmed that all clinics would remain closed tomorrow, and all elective surgeries scheduled for Friday were cancelled. An exception is the dialysis clinic at the Jackson Medical Mall, which remains operational and open for scheduled appointments.
“ Patients in our hospital and in our emergency department are being cared for. Clinical equipment and operations remain functional,” Woodward continued. “For our students in-person classes will continue as scheduled.”
An FBI agent attended UMMC’s presser, with Special Agent in Charge Robert A. Eikhoff speaking on behalf of the agency. Eikhoff declined to provide specifics on the type of ransomware or the origins of the attack in comments to the Mississippi Free Press.
“ At this point in the incident it’s too early for us to communicate what we do and don’t know, but we are in the process of surging resources, both locally and nationally, into this incident to make sure that we are standing alongside with UMMC and their vendors.”
Mississippi MED-COM, the coordinating network for hospital transfers across the state, is also impacted by the ransomware attack. But Woodward clarified that “redundancies” were in place to continue routing patients to hospitals without disruption.
Ransomware’s Impact
Ransomware is a sophisticated attack on an institution or individual, in which an illicit program encrypts the machines connected to a computer network, rendering them inaccessible by any means until the attacker disables the attack, usually demanding difficult to trace cryptocurrency payments well into the millions of dollars to evade capture.
Ransomware attacks remain the most significant form of cybercrime, extracting millions from their targets on average. Increasingly, artificial intelligence is providing new avenues for attackers to infiltrate institutional systems, making both penetrating defenses and social engineering methods significantly easier.
For Mississippians, the cost of the attack may be difficult to estimate in dollars. Social media posts show countless residents facing the cancellation of important medical appointments. Most have no way of contacting their healthcare providers, though Woodward said today that a phone line to provide more information was in the works, although this service was not available by press time. All “elective” procedures are cancelled, meaning patients should only expect treatment for serious emergencies.
And even in the case of procedures which continue, patient outcomes during ransomware attacks are dramatically worse, explained Dr. Jeff Tully, co-director at the University of San Diego’s Center for Healthcare Cybersecurity.
“Four years ago, we looked at emergency department patients that were being treated in a town with a ransomware attack,” Tully told the Mississippi Free Press in an afternoon interview. “In a followup study a year later looking at that same attack, for patients who had a cardiac arrest—you had about a 40% chance of surviving with an intact brain before the attack. During the attack that number went down to 4.5%.”
That is a tenfold risk in death for a common, life-threatening emergency, along with 40% longer waits in the ER for hospitals surrounding ransomware attacks. More strokes and higher mortality are also within what Tully called the “blast radius” of such an attack.
Even so, it’s difficult to truly quantify the severe damage of ransomware attacks on hospitals. “It’s really almost like fog of war,” Tully said. “Because a lot of that data would be contained within electronic health records. Well, that’s what goes out in these attacks.”
And this disruption to health systems is increasingly lasting longer and longer. “Ten years ago, ransomware attacks lasted three, four, five days,” Tully said. “The trend with these types of attacks the last four or five years, to last weeks to months is not uncommon.”
At UMMC clinics, significant procedures, up to and including chemotherapy, have been cancelled. Noelle Covington, a Mississippi mother, told the Mississippi Free Press in an interview that she’d been waiting at Sanderson Tower at the Mississippi Children’s Hospital for an appointment early this morning for her child. One by one, parents were instructed to leave: without records systems, their appointments couldn’t be completed.
Full Scope of Attack Still Unclear
The cancellation of so many appointments and procedures may be harmful. But hospital leadership said the cancellations were necessary for the hospital system to stabilize itself. “ Our top priority is to be sure that we can still provide that care to the patients at the bedside … we are trying to mitigate the volume a little bit so that we can give the attention to those emergency and urgent cases and, and quiet things down a little bit on the elective front until we get a better handle on all of this,” Woodward said.
Woodward couldn’t comment on what protected health information may have been compromised in the attack. “ Those are the pieces that are still being determined. But as I said earlier, we have taken our systems down. We are working to mitigate all the risks that we know of.”
The closest comparison to what happened at UMMC today may be the Ascension Health ransomware attack from late 2024. Then, a breach caused by an employee downloading an infected file compromised nearly 5.6 million healthcare records–and caused roughly six weeks of downtime across numerous hospitals before normal operations resumed. For Ascension, the fallout continues, with a class action lawsuit alleging the healthcare provider failed to properly protect customer records.
It is not clear if any information has been extracted in this morning’s attacks.