Skip to content
DysruptionHub
Sign in Subscribe

DHR Health cyberattack disrupts care systems and exposes data

Summary

DHR Health logo

A March 2025 cyberattack disrupted DHR Health information systems, canceled catheterization-lab cases and required paper workflows while its South Texas hospitals remained open. A later notice identified unauthorized access March 18–20. The federal breach archive now confirms exfiltration affecting 34,060 people. The final IT recovery date, entry method and responsible actor remain unverified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Unresolved

Attack mechanisms

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Email disruption

    Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Healthcare operations disrupted

    Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.

  • Event or activity cancellation

    Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • No known extortion indicator

    Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.

Incident narrative

Analyst assessment

DHR Health experienced a confirmed cyberattack that disrupted information systems in March 2025. The South Texas health system acknowledged the incident March 20, saying its technology teams were restoring functionality while staff used backup procedures. A later DHR privacy notice, preserved on a law firm’s website, placed unauthorized access between March 18 and March 20. That access window is distinct from the service disruption reported March 20.

The federal breach archive now lists 34,060 affected individuals under Doctors Hospital at Renaissance, Ltd., DHR’s legal entity. Its investigation summary confirms unauthorized network access and exfiltration of protected health information, including demographic information. May 15, 2025, is the listed regulatory submission date. The current count supersedes the early 501-person placeholder reported while the review was underway.

Operational significance

DHR said its hospitals and clinics, including facilities in Edinburg and Brownsville, remained open. That continuity did not mean every service operated normally: its March 21 statement acknowledged canceled catheterization-lab cases. KRGV’s separate reporting described employees’ computer and email limitations, paper patient documentation and a family’s missed cardiology appointment in McAllen. DysruptionHub also reported phone outages; DHR provided a dedicated contact number during restoration.

A March 26 DHR statement reported progress restoring some digital systems while paper workflows continued. It supports partial restoration rather than a precise date when all affected technology returned to normal.

Confidence and uncertainty

Confidence is high in cyber involvement, operational disruption and data exfiltration because the record combines direct DHR statements, contemporaneous reporting and the federal breach finding. The earliest located public cyber acknowledgment and disruption disclosure came from DHR on March 20. No earlier external cyber disclosure was established.

The incident is assessed as presumed resolved because it is historical and no continuing outage was identified. The record does not establish the exact final recovery date; the former April 6 end date lacked support. March 26 is the latest verified operational-impact observation in this review.

Analytic gaps

The entry method, complete system inventory, final restoration date and responsible actor remain unverified. No supported ransomware or encryption finding, ransom demand or public leak was located. Searches of DHR’s name, domain and legal-name variants returned no matching ransomware claims. These negative checks do not establish that extortion never occurred.

Organizations involved

Impacted locations

  • Brownsville, Texas

    DHR’s official locations directory https://dhrhealth.com/locations/ identifies DHRHealthBrownsville hospital at4750NExpressway77. The original March21DHRstatement explicitly includes BrownsvilleHospital in facilities open during system restoration. City’s original Chapter380 hospital-expansion statement https://www.brownsvilletx.gov/m/newsflash?cat=58 independently identifies this hospital as within its city. Exact and normalized Census address requests returned no match; no coordinate precision is claimed. Brownsville is a physical hospital-city anchor, not an affected municipal authority or blanket outage.

    Source

  • Edinburg, Texas

    DHR’s official locations directory https://dhrhealth.com/locations/ lists its main hospital at5501SouthMcCollRoad,Edinburg. Exact U.S.Census street match5501MCCOLLRD verifiesEdinburgcity4822660/HidalgoCounty48215. March20–26 statements establish system disruption with hospitals remaining open. Reuse existing municipality as physical site context; no citywide outage or hospital-facility location is asserted.

    Source

  • McAllen, Texas

    Medium Confidence

    Original March21KRGV reporting https://www.krgv.com/news/dhr-health-it-teams-working-to-restore-hospital-systems-following-cyberattack records a family’s missed DHRcardiology appointment inMcAllen; official directory https://dhrhealth.com/locations/ independently lists DHRclinics inMcAllen. Exact cardiology office not identified, so mediumconfidence city-site anchor only. Do not infer every McAllenclinic or municipal services were affected.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.