Skip to content
DysruptionHub
Sign in Subscribe

Cyberattack disrupts Community Health Northwest Florida care

Summary

Community Health Northwest Florida logo

A Dec. 24, 2024, cyberattack disrupted Community Health Northwest Florida’s communications and clinical services. Staff used paper records, and a later investigation confirmed unauthorized access to files.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Unresolved
Attribution:
Unresolved

Attack mechanisms

Data impacts

  • Unauthorized data access

    An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Email disruption

    Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Healthcare operations disrupted

    Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Event or activity cancellation

    Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Ransom demand

    The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

  • Countdown or payment deadline

    The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.

Incident narrative

What happened

Community Health Northwest Florida disconnected its network after a cyberattack disrupted operations on Dec. 24, 2024. The nonprofit provider, legally Escambia Community Clinics, Inc., said in its March 2025 notice that the disruption affected access to data and systems. Outside cybersecurity specialists assisted with containment and investigation.

The Pensacola News Journal reported Dec. 27 that the provider had taken servers offline as a precaution. Phone, email and internet service were unavailable.

Operational significance

WEAR reported that clinics closed Dec. 26 because of the attack, following a scheduled Christmas closure. Dental appointments were canceled for later rescheduling. Primary and pediatric appointments were retained as services resumed with reduced technology access. Dental, pharmacy, X-ray and mammography services were affected.

All 17 locations were open Dec. 30 with limited connectivity, according to a provider update carried by La Costa Latina. Staff used paper charts and prescriptions, and patients were warned of longer waits. New prescriptions at the Jackson Street site required printed prescriptions; online refill availability remained conditional on connectivity.

A Jan. 10 recovery report said communications had returned and patients could again contact clinics for appointments and prescriptions. The provider retained its temporary hotline as a backup.

Confidence and uncertainty

The provider’s public statements establish a cyberattack and operational disruption. Early assurances about patient information reflected an incomplete investigation. In its Jan. 26, 2026, notice, the provider confirmed that an unauthorized party had accessed its network and certain stored files. Information varied by person and included medical, insurance, identity and financial information. That notice did not establish that files were copied or that information had been misused.

The HHS breach portal lists 143,969 affected individuals for the legal entity’s network-server hacking report submitted Feb. 3, 2025. That is the report submission date; the provider identifies Dec. 24 as the disruption date.

Analytic gaps

The initial entry method, full unauthorized-access period and exact day of complete clinical-system restoration remain unresolved. Communications recovery does not establish when every affected application returned. Comparitech reported Jan. 14, 2025 that RansomHub had claimed responsibility, alleged theft of 68 GB and demanded payment. The provider had not verified that claim. The reviewed official notices confirm unauthorized file access but do not identify a responsible group or confirm ransomware encryption. Ransomware.live independently recorded a listing for the provider’s exact domain Jan. 13, 2025; that observation is not the original actor-post timestamp.

Threat actor and claim

RansomHub

Listed as: healthcarewithinreach.orgSource: ransomware.liveDiscovered:

Claim details

Ransomware.live observed a RansomHub listing for the provider’s exact domain on Jan. 13, 2025. Comparitech reported Jan. 14 that the group claimed responsibility, alleged theft of 68 GB and set a one-week payment deadline for an unspecified sum. This is an extortion allegation; the provider had not confirmed RansomHub’s involvement. Official notices later confirmed unauthorized network and file access but did not identify an actor, confirm encryption or establish that files were copied. The tracker discovery time is not the original actor-post publication time. Reporting: https://www.comparitech.com/news/ransomware-gang-says-it-hacked-pensacola-fl-medical-clinics/

Organizations involved

Impacted location

  • Pensacola, Florida

    Pensacola contains the provider’s verified administrative office and affected clinical services. Original reporting documents disrupted communications, clinical technology and prescriptions, including the Jackson Street pharmacy. This municipality anchors affected provider operations; it does not describe an outage of Pensacola city government or every local healthcare provider.

    Source

Sources

Notice of Data Event
Community Health Northwest FloridaPublished: Retrieved:
  • Type: Official Statement
  • Stance: Report
  • Platform: Website
  • Medium: Web
Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.