Frederick Health
Frederick Health ransomware disrupts patient services
Summary
A Jan. 27, 2025, ransomware attack disrupted Frederick Health’s clinical and administrative systems, requiring downtime procedures and delaying services. EHR restoration on Feb. 18 preceded recovery of the patient portal. The provider later confirmed stolen patient files; HHS records list 934,326 affected people.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
-
Supply chain compromise
Compromise of a trusted third party, supplier, software provider, or service provider used to affect downstream victims.
Data impacts
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
-
Data encryption
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Scheduling disruption
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
-
Healthcare operations disrupted
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
-
Facility closure
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
A Jan. 27, 2025, ransomware attack disrupted Frederick Health’s clinical and administrative systems in Maryland. The provider took systems offline and continued care using backup and downtime procedures, according to its original Jan. 27 statement. Its later audited financial statements reported that an attack on a connected third-party vendor enabled entry into the network, where ransomware encrypted some servers.
Operational significance
The attack disrupted access to systems and patient information while facilities generally remained open. WFMD’s early Jan. 27 report described ambulance diversions to nearby facilities, citing a community fire-calls page. That report does not establish the duration of diversion or a complete hospital closure. In his Feb. 6 update, CEO Tom Kleinhanzl confirmed that the emergency department was open to walk-ins and all EMS transports.
The provider’s auxiliary newsletter described unavailable surgery-status and scheduling information, interrupted phones and unavailable real-time patient and visitor systems. Volunteers used temporary spreadsheets, daily paper lists and telephone checks to support care and visitor coordination.
By Feb. 7, most services were open, but Frederick Health Village Lab was closed, electronic prescription requests and the patient portal were unavailable, and patients faced delays. The EHR was restored by Feb. 18, allowing scheduling to resume; the portal remained unavailable in the Feb. 19 report. The audited statements also describe delayed billing and collections. Technical restoration and financial recovery were separate processes.
Confidence and uncertainty
Confidence in the ransomware assessment is high because the provider explicitly confirmed it and subsequently documented server encryption. Its March 28 patient notice confirmed that an unauthorized person copied files from a file-share server on Jan. 27. Information varied by person and could include identity, Social Security, insurance, medical-record and clinical information outside the Electronic Medical Record.
The original HHS breach register lists 934,326 affected people in Frederick Health’s Maryland report submitted March 28. Its expanded description repeats that count. The regulatory listing documents a reported breach; it does not by itself establish a penalty or finding of liability.
Analytic gaps
The vendor’s identity, precise initial access technique, responsible group and ransom or payment outcome remain unverified. The final patient-portal restoration date and completion of billing recovery are unknown. Operational status is presumed resolved based on elapsed time, without assigning an unsupported date when every affected service returned to normal.
Organizations involved
Impacted location
Frederick, Maryland
Frederick city contains the affected system’s main hospital campus. Documented impacts included clinical downtime procedures, early reported ambulance diversions, interrupted patient systems and administrative delays. The city is a site-level physical anchor; this relationship does not claim a citywide outage.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.