Cayuga Health hospital cyberattack

Analyst assessment

An attempted cyberattack disrupted Cayuga Health hospital operations in New York on Feb. 18, 2025. The health system isolated several systems and used downtime procedures while assessing the attempt. Becker’s Hospital Review identified both Cayuga Medical Center, near Ithaca, and Schuyler Hospital in Montour Falls as affected hospitals that temporarily diverted patients.

The organization described the attack as unsuccessful. That description does not erase the documented disruption, but it also does not establish that an attacker penetrated the network, encrypted records or stole patient information. The technical mechanism and perpetrator remain unknown.

Operational significance

At Cayuga Medical Center, emergency admissions and ambulance arrivals were restricted from about 8 p.m. to 10:45 p.m., according to the Ithaca Voice’s original reporting. Staff checked in patients on paper, delays developed and some people left without being seen. An ambulance already traveling to the hospital was redirected to Cortland. The hospital said stroke and serious heart attack patients required diversion under state rules during the outage. A separately planned patient transfer was unrelated to the shutdown.

Becker’s reported roughly four hours of diversion at the two hospitals, quoting a Cayuga Health spokesperson. That broader estimate should not replace the more specific interval reported for Cayuga Medical Center or establish identical recovery times at each hospital. Some Cayuga Medical Center systems were still offline at 11:30 p.m., after admissions resumed.

By the morning of Feb. 19, a spokesperson told WHCU/607 News Now and 14850.com that all systems were back online. The health system also told Becker’s it was providing inpatient and outpatient care without further interruption. These statements support resolved status and a Feb. 19 restoration date, rather than treating the earlier end of diversion as full technical recovery.

Confidence and uncertainty

Confidence is high that a cyberattack attempt and the defensive response caused a short operational disruption: named reporting includes direct hospital statements, patient-care restrictions and recovery updates. The health system said there was no negative impact to patients; that is its assessment and should be read alongside the documented diversions and delays. The reviewed reporting does not establish a physical injury or death caused by the incident.

No reviewed evidence establishes ransomware, a ransom demand, an identified threat actor or unauthorized disclosure of patient information. Temporary system isolation and paper check-ins support an availability impact without proving encryption or data theft. The incident does not establish disruption across every Centralus Health affiliate.

Analytic gaps

The initial access attempt, affected applications, forensic findings and incident-specific costs have not been established in the reviewed sources. An exact restoration time for each hospital is unavailable. Later evidence of a privacy incident or financial loss would require separate verification before inclusion.