Group Health Cooperative of South Central Wisconsin temporarily lost access to several systems after isolating its network in response to an intrusion detected Jan. 25, 2024. The cooperative confirmed stolen health information and a failed encryption attempt, and said systems were restored; Wisconsin lists 533,809 affected people.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor directly contacted the victim through a ransom note, email, chat portal, telephone call, messaging platform, or other communication channel.
Group Health Cooperative of South Central Wisconsin isolated its network after detecting an intruder on Jan. 25, 2024, temporarily interrupting several systems. The Madison-based health care and insurance cooperative later confirmed that protected health information had been stolen. Systems were restored, although a precise recovery date has not been established.
The cooperative’s notification letter preserved by Massachusetts regulators says it announced unauthorized network access on its website Jan. 25. That acknowledgment preceded the BlackSuit listing discovered in March. The letter confirms an unsuccessful attempt to encrypt systems; failed encryption did not prevent either data theft or containment-related downtime.
The April 9 public notice attributes temporary system unavailability to deliberate network isolation. Outside incident-response specialists helped restore services. This establishes an operational interruption at an organization that both provides clinical care and administers health insurance, but does not identify each affected application or establish canceled treatment, ambulance diversion or patient harm. The notice describes systems returning online; subsequent notification and litigation activity does not establish a continuing outage.
Confidence is high in the intrusion, temporary unavailability and theft because the cooperative directly acknowledged them. Wisconsin’s consumer-protection registry lists 533,809 affected people, including current and past members and patients of its providers. The cooperative identified possible exposure of contact details, birth or death dates, Social Security numbers and health-plan identifiers.
The BlackSuit listing identifies ghcscw.com, but the cooperative’s notice names only a foreign ransomware gang. The actor’s detailed inventory remains unverified. March 9 is the tracker’s discovery date, not an established publication date. Wisconsin lists Feb. 9 as public notification, while the cooperative’s letter describes its earlier Jan. 25 intrusion announcement; these describe different stages of disclosure.
The initial entry method, extent of access before detection, affected systems and individual interruption durations remain unknown. Public evidence does not establish an exact restoration date, a ransom amount or payment, or independently confirm BlackSuit’s responsibility.
BlackSuit listing indexed March 9, 2024, identifies ghcscw.com. The provider independently confirmed copied personal health information and disruption, but said the attempt to encrypt systems was unsuccessful. The actor’s detailed data inventory is an allegation, not a verified forensic finding.
Dane County contains the cooperative’s office at 1265 John Q. Hammons Drive in Madison. The cooperative temporarily interrupted its systems while responding to unauthorized access; this location identifies the affected organization’s physical office rather than a countywide outage or an attack on county government.
Madison is the physical anchor of the affected cooperative, identified in its public notice and consumer notification address. The evidence establishes system interruption without identifying effects at individual facilities.
The cooperative describes network isolation, temporary system downtime, failed encryption and copied protected health information. External responders assisted restoration.
The tracker records a BlackSuit victim listing using the ghcscw.com domain and an extensive alleged data inventory.
The victim says it announced unauthorized network access on its website Jan.25,2024. Its response temporarily interrupted systems; attempted encryption failed, information was copied and systems were restored.
The registry lists533,809 affected people and February9,2024 as public notification. It describes current and past members and patients of the cooperative’s providers.
Signed-in members can report an error, update, or missing source.
