Governor Juan F. Luis Hospital and Medical Center cyberattack

Analyst assessment

A cyberattack at Governor Juan F. Luis Hospital and Medical Center on St. Croix disrupted its network, clinical information systems and billing workflows in April 2025. Patient care continued through workarounds and outside support. The hospital’s April 27 notice said it had identified an incident affecting its networks that day. Later accounts by its spokesperson, federal responders and the chief executive date the incident to April 26. The record uses April 26 for onset while preserving that difference in the initial disclosure.

The direct hospital acknowledgment, federal response account and documented outages support a confirmed cyberattack assessment with high confidence. Recovery of important systems was still incomplete in October.

Operational significance

In an April 28 WTJX interview, hospital spokeswoman Aniah John said the internet and internal network were down and the hospital had activated its Incident Command Post. She said inpatient and outpatient care continued. That assurance describes continued delivery of care, rather than normal electronic operations.

ASPR’s July 2 response account documents an offline picture archiving and communication system and restricted access to clinical applications. Emergency imaging remained possible, but transmitting, viewing and reporting studies required alternatives. Federal telemedicine teams supplied secure connectivity, remote specialist access and support for more than 250 radiology studies, including backlogged cases.

At an October 15 town hall, CEO Darlene Baptiste described months of paper workflows and electronic billing delays. The Virgin Islands Consortium reported that 80%–85% of staff had regained Meditech access, while financial and business office systems were still returning. Baptiste corrected her description of $750,000–$800,000 a week as money lost: it was cash flow delayed by untimely electronic billing, not established permanent loss.

WTJX reported in May 2026 that Baptiste attributed continuing claims-processing, billing, collections and cash-flow constraints partly to the April 2025 attack. She described delayed remittance of payroll-related obligations amid broader financial strain. The hospitals’ total outstanding balances are not established cyberattack losses, and these financial consequences do not prove that the original systems outage continued into 2026.

Confidence and uncertainty

Governor Albert Bryan Jr. called the event ransomware during his April 28 briefing, as reported by the Consortium. The hospital spokesperson did not then confirm that characterization or disclose whether anyone demanded payment. Ransomware involvement is assessed with medium confidence; confirmed encryption, a specific malware family and an extortion demand are not established.

Baptiste later said attackers accessed one drive through an overlooked vulnerability involving two local servers and denied compromise of patient or staff personal information. Those are attributed findings, without a published forensic report, identified vulnerability or independent verification of the complete data scope. The evidence clearly establishes unavailable clinical information; it does not establish stolen personal data.

Analytic gaps

The reviewed record does not identify an attacker, ransom amount, payment outcome, full recovery cost or exact final restoration date. Name, domain and supported alias searches yielded no matching ransomware tracker claim. The separate Virgin Islands Lottery and Schneider Regional incidents are not merged into this event.

The operational status is presumed resolved because the documented disruption is historical and the research has not established a continuing outage. This is not a verified all-clear. October 15 is the latest directly dated recovery observation reviewed so far, and the initial statement that care continued does not negate the prolonged disruption of clinical and administrative workflows.