Cookeville Regional Medical Center’s July 2025 ransomware incident disrupted internet access, computer systems and scheduling while the hospital remained open. Later notices identified unauthorized access to personal information; Rhysida responsibility remains unconfirmed.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
The organization lost or materially restricted internet connectivity.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
Services continued but with longer processing, response, delivery, or completion times.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Cookeville Regional Medical Center experienced a confirmed ransomware incident in July 2025. The hospital’s current incident statement identifies ransomware, while its later notification template dates discovery to July 14 and unauthorized access to July 11–14. These dates describe intrusion and discovery, distinct from the July 13 computer outage reported in its original July 15 statement.
The initial July 14 disclosure acknowledged unauthorized network access and a precautionary internet shutdown. This supports the original cyber assessment in our July 15 reporting. The early suggestion of access from outside the United States does not establish an attacker identity or state sponsorship.
The hospital remained open, but continued care did not mean normal technology operations. Its July 15 statement described slow scheduling and technology while staff worked to restore systems. Becker’s Aug. 5 report still described computer-system disruption and possible delays in results and scheduling. The reviewed evidence does not establish a hospital closure, ambulance diversion or interruption to every clinical service.
The public hospital authority serves a 14-county region in Tennessee’s Upper Cumberland area.
Confidence is high in the cyber and ransomware assessments because the hospital acknowledges both. Its data-incident notice says an unauthorized party viewed or acquired files that could contain identifying, financial, medical and insurance information. The file review finished March 16, 2026. That wording does not establish that all affected files were stolen or publicly released.
Rhysida responsibility remains a low-confidence claim. The external victim listing names CRMC, and Comparitech reports a demand of 10 bitcoin for purportedly stolen data. The hospital has not confirmed that attribution, and the reviewed record does not establish payment. Comparitech reports 337,917 notified people; that figure is attributed reporting rather than an independently inspected regulator total.
The public record does not establish initial access, encryption extent, the complete exfiltration scope, ransom negotiations or an exact restoration date. Aug. 5 is the latest precisely dated operational-impact report verified here. Disruption is presumed resolved because of the elapsed time, without assigning a recovery date.
The hospital’s financial-report note records an initial notification to 126 individuals on Sept. 12, 2025, with more review and notices to follow. This initial group is distinct from the later reported total. Notification milestones and file-review completion do not establish that operational systems remained unavailable until those dates.
Rhysida claimed CRMC in an external victim listing discovered August 2, 2025 at 11:17:24 UTC. Comparitech reports a 10-bitcoin demand for purportedly stolen data. Responsibility, actor data provenance and payment are not independently confirmed by the hospital; ransomware confirmation does not establish Rhysida attribution.
Cannon County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Clay County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Cookeville contains the affected hospital at 1 Medical Center Boulevard. This place anchor is distinct from CRMC’s multi-county service remit and does not imply an outage of city government.
Cumberland County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
DeKalb County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Fentress County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Jackson County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Macon County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Overton County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Pickett County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Putnam County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Smith County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Van Buren County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Warren County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
White County falls within the affected public hospital authority’s documented service area. Its inclusion identifies the community served; it does not establish that every resident, health care provider or county government experienced disruption.
Our report described unauthorized access and a precautionary hospital internet shutdown while inpatient, outpatient and emergency care continued.
The hospital reported unauthorized network access, an internet shutdown for safety, continued investigation and remaining fully open to patients.
The hospital described a July13 computer-system outage and suspected ransomware, with forensic assistance and recovery work. Its CEO said care continued while technology and scheduling were slow.
Computer systems remained disrupted, according to the August5 report. Patient care continued, but delays in receiving results and scheduling were possible while restoration work continued.
Hospital NoteR reports ransomware and July11–14 unauthorized access. It says126 individuals and federal regulators were initially notified September12,2025, with further document review and notices pending.
The report says337917 people were notified and Rhysida claimed the hospital, demanding10bitcoin for purportedly stolen data. It explicitly says attribution is unverified and payment and entry method are unknown.
The hospital identifies ransomware, says a technical outage affected computer systems throughout the organization, and describes investigation of claims that sensitive information was accessed.
The provider notice dates unauthorized access to July11–14,2025 and says files were viewed or acquired. Depending on the individual, affected data may include identity, financial-account, medical and insurance information.
The provider’s notification template says ransomware was discovered July14,2025 and affected-file review finished March16,2026. It describes one year of identity protection and says no evidence of fraud or identity-theft misuse had been found.
External listing names Cookeville Regional Medical Center and crmchealth.org under Rhysida. Discovery timestamp is August2,2025 at11:17:24UTC.
Signed-in members can report an error, update, or missing source.
