Endless Mountains Health Systems

Analyst assessment

Endless Mountains Health Systems experienced a cyberattack on March 3, 2025, according to a Pennsylvania Emergency Management Agency report. The nonprofit health system publicly acknowledged the attack March 5. Its hospital uses a Montrose, Pennsylvania, mailing address but is physically in Bridgewater Township, Susquehanna County.

The hospital’s March 5 statement and March 6 update, preserved in a March 7 web snapshot, described unavailable systems and work with cybersecurity specialists. Staff continued providing services while investigating and restoring the affected environment.

Operational significance

The disruption affected patient access as well as administrative work. PEMA documented an initial suspension of patient intake and emergency-department ambulance diversion. Walk-in patients were being accepted March 7, while ambulance arrivals remained restricted. The agency subsequently reported that the emergency department resumed accepting ambulances March 14. That is a documented care-access recovery milestone, rather than evidence that every IT system was restored.

For appointments, laboratory testing, imaging and surgical visits, EMHS asked patients to bring identification, insurance cards, medication and allergy information, and test orders. It provided separate contact numbers for pharmacy and rehabilitation services. Those instructions show how routine care depended on patients carrying information that would otherwise be available through normal workflows. A March 13 HealthcareInfoSecurity report identified electronic health records among the affected systems, citing EMHS’ public statements.

The outage also affected fingerprinting services offered by EMHS. In a March 10 official update, the hospital said it still could not connect to the IdentoGO system and expected another week of disruption. It expressed a hope to resume service; the post did not confirm recovery. This documents EMHS’ inability to deliver that service and does not establish that IdentoGO itself was compromised.

Confidence and uncertainty

Official hospital acknowledgment and state operational reporting support high confidence in a cyber incident with healthcare disruption. Contemporaneous DataBreaches reporting also documented early service-contact problems and the hospital’s public updates.

The reviewed evidence does not establish a particular intrusion method, ransomware deployment, encryption or data theft. No independently verified perpetrator, ransom demand or payment is identified. Instructions to protect sensitive data and bring documents do not, by themselves, establish that patient information was stolen.

The incident is assessed as presumed resolved. Ambulance acceptance was positively restored March 14, but the reviewed evidence does not establish when all clinical, communications and ancillary systems returned to normal. The March 13 report continued to describe IT disruption. The exact date all electronic records and ancillary services became available remains unverified.

Analytic gaps

The initial entry time, complete affected-system inventory, final forensic findings, privacy impact, recovery costs and exact date of full restoration remain unverified. The initial attack date comes from PEMA’s retrospective account and does not establish how long intruders had access beforehand. No confirmed patient-injury count is available in the reviewed evidence.