Cedar County Memorial Hospital experienced a cyber incident that led it to shut down its IT networks, use hospitalwide downtime procedures and partially divert emergency patients who needed advanced imaging. Routine operations returned Aug. 28, while ransomware, Wallstreet responsibility and possible patient-data exposure remain unconfirmed.
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal or external network connectivity was unavailable or materially impaired.
The organization lost or materially restricted internet connectivity.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
A specific application or software platform became unavailable or unusable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
The disruption created or increased a risk to physical safety, public safety, patient safety, industrial safety, or safe operations.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
DysruptionHub assesses with high confidence that Cedar County Memorial Hospital experienced a confirmed cyber incident beginning Aug. 14, 2026. The hospital’s official incident update documented an information technology disruption that required a voluntary network shutdown and outside forensic investigation. A Sept. 10 report by OzarksFirst characterized the event as a cyber incident, and a Wallstreet leak-site listing provides a direct public cyber claim.
The evidence does not establish that ransomware encrypted hospital systems or that Wallstreet caused the incident. DysruptionHub assesses ransomware involvement and Wallstreet attribution with low confidence because CCMH has not confirmed either proposition and the public claim has not been independently corroborated.
CCMH said internet access, its patient portal and its Meditech electronic health record were unavailable at the hospital and Medical Mall Clinic. In an Aug. 17 Facebook notice, the hospital asked patients to bring paper physician orders and current medication lists and warned of longer waits while staff used downtime procedures.
Imaging systems could not transmit files to radiologists. The emergency department remained open but partially diverted trauma or critical patients who required immediate advanced imaging. In an official reply accompanying its Aug. 23 Facebook update, the hospital also said it temporarily was not accepting card payments and would resume only when it was safe.
Clinical care continued under backup procedures, but clinical records, electronic orders, patient access, payment processing and diagnostic-imaging workflows could not operate normally. In its Sept. 10 update, the hospital reported treating 170 emergency patients, admitting 12 patients, seeing 303 Medical Mall Clinic patients and 203 Specialty Clinic patients, completing 15 surgeries and performing 286 radiology scans during the downtime. These figures document care delivered under workarounds, not uninterrupted access to normal systems.
CCMH reported Aug. 28 that routine operations had returned, Meditech and the patient portal were restored, electronic orders resumed and ambulance diversion ended. Staff still had to enter manually kept records into the EHR, but the restoration statement supports treating the operational disruption as resolved Aug. 28. The continuing forensic investigation does not by itself indicate continuing service disruption.
The hospital has described the event as an IT disruption and has not confirmed ransomware, Wallstreet responsibility or patient-data compromise. External reporting and the Wallstreet listing provide the public cyber characterization; CCMH’s statements provide direct evidence of disruption and recovery.
Confidence is high that the disruption occurred and materially affected hospital operations because CCMH documented the network shutdown, system outages, longer waits, manual workarounds, payment limitations, imaging limitation, partial diversion and restoration timeline. Cyber involvement is confirmed from credible external characterization and a stable threat-actor claim, but confidence is lower on technical cause because the hospital has not released a forensic finding.
Electronic clinical records were unavailable during the EHR outage. Whether patient information was accessed or stolen remains unresolved. The hospital’s Sept. 10 statement and a Sept. 17 HIPAA Journal report said patient-information involvement remained under investigation. The lawsuit and Wallstreet claim allege data theft, but those allegations do not establish unauthorized access, exfiltration, publication or the categories and number of records involved.
The public record does not establish the initial access vector, exploited vulnerability, compromised account or host, dwell time, malware family, encryption scope, ransom demand, payment status, data-exfiltration scope, affected data categories, number of affected people or whether any authentic hospital data was published. It also does not establish whether a third-party provider contributed to the intrusion.
A ransomware group calling itself Wallstreet published a page naming Cedar County Memorial Hospital on its data-leak site Aug. 28. The page showed the claim’s countdown at zero and provided access to a browsable dump of files that Wallstreet claimed came from the hospital. We reviewed the page but have not independently verified the files’ authenticity, scope or source.
Models the public hospital’s county service remit, not countywide outage.
Physical anchor for CCMH at 1401 S. Park St.; not a claim of premises damage.
The published article documents outage, manual clinical work, partial diversion and Aug. 28 restoration. It reports DysruptionHub reviewed Wallstreet’s page and browsable files but did not verify authenticity, scope or origin.
Cedar County Memorial Hospital reported that it transitioned its public website and email presence to the cedarcountymemorial.org domain, supporting the canonical organization domain and website correction.
CCMH reported a significant IT systems outage, asked patients to bring paper physician orders and current medication lists, said the patient portal was unavailable and warned of longer waits.
CCMH documented an Aug. 14 IT-network disruption, voluntary network shutdown, internet and patient-portal outages, EHR downtime, hospitalwide backup procedures and partial emergency-department diversion. Its Aug. 28 update said routine operations, Meditech, the patient portal and normal emergency intake had been restored.
CCMH said the Aug. 14 disruption affected its electronic health record, patient portal and some systems at the hospital and Medical Mall Clinic; most systems had returned, but the emergency department remained on partial diversion for advanced imaging.
CCMH documented Aug. 14 network shutdown and EHR/portal downtime, partial emergency diversion, and Aug. 28 restoration. Its Sept. 10 update said most online systems returned within one week, Meditech remained offline two weeks, and staff treated 170 emergency patients and completed 15 surgeries during downtime. Patient-data involvement remained under investigation with forensic experts and the FBI.
CCMH reported routine operations had returned, the electronic health record was fully online, registration and electronic orders had returned to normal, the MHealth patient portal was accessible and ambulance diversion had ended.
OzarksFirst reported that CCMH was investigating an August cyber incident with forensic experts and the FBI. A lawsuit alleged ransomware and data theft by Wallstreet, while CCMH had not confirmed patient-data theft.
The Cedar County section corroborates Aug. 28 routine-operation restoration and an ongoing Sept. 10 investigation, while explicitly treating Wallstreet’s claim as unverified.
The Missouri State Auditor identifies Cedar County Memorial Hospital as a Cedar County political subdivision and taxing authority, supporting classification as a public-sector hospital with a Cedar County service area.
Ransomware.live indexed a Wallstreet claim naming Cedar County Memorial Hospital and cedarcomem.com as the alleged victim. The listing establishes the claim’s existence, not ransomware, data theft or actor responsibility.
Signed-in members can report an error, update, or missing source.
