Ascension ransomware attack

Ascension publicly acknowledged cyber activity and interrupted clinical operations on May 8, 2024, according to contemporary reporting reproducing its statement. A surviving provider announcement dated May 9 confirms the system interruption and clinical effects. The health system engaged Mandiant, notified authorities and asked business partners to suspend connections while it investigated.

Analyst assessment

The incident involved ransomware and substantial disruption across a multistate health network. The victim notice filed with Washington’s attorney general reports copying of files on May 7 and 8; those findings distinguish known earlier activity from detection and public disclosure. Copied files and unavailable clinical records are separate data impacts. In its June 12 update, reported by BleepingComputer, Ascension said a worker accidentally downloaded a malicious file believed to be legitimate. That account does not establish a phishing delivery channel or malicious insider.

Operational significance

Healthcare Dive’s provider-update tracker documents electronic-record and patient-portal outages, pharmacy disruption, manual procedures and ambulance diversions in some markets. Effects varied by facility and region. The network’s presence in a state does not establish that every care site experienced every listed consequence.

Ascension reported networkwide EHR restoration in mid-June. The tracker records a June 14 restoration announcement and a June 20 note that systems were back online, while identifying a backlog of information collected during downtime. Clinical access returning did not immediately clear every administrative effect.

Partners also changed their workflows. A May 9 Alverno Laboratories notice says it disconnected applications, required physical laboratory orders and returned results by fax or an office printer. Alverno reported normal turnaround under that backup process and no indication its own systems were compromised. R1 RCM’s regulatory filing describes disconnection, manual revenue-cycle delivery and subsequent reconnection after security review; R1 reported no evidence its systems or data were compromised.

Confidence and uncertainty

Cyber involvement and clinical disruption are established by the provider’s contemporaneous acknowledgment. Ransomware and file copying are confirmed in the victim’s filed notice. A February 2025 supplement says its affected-data analysis and notification mailing were complete; that is a privacy-response milestone, rather than a clinical restoration date. The historical incident remains presumed resolved, without one verified date when all effects ended.

December reporting and Ascension’s subsequent financial report describe continued revenue-cycle recovery. The financial report discusses combined effects of the May attack and February’s separate clearinghouse incident; its financial totals cannot all be assigned to this attack. Later notification and investigation milestones do not establish continued clinical downtime.

Analytic gaps

The complete facility-level timeline, initial entry date, precise delivery mechanism, exact end of operational recovery and incident-specific final cost remain unresolved. Health-ISAC’s 2025 threat report attributes the attack to Black Basta and says the association assisted Ascension. Its published account does not provide the underlying forensic evidence or establish a public actor claim, ransom demand or payment.