Skip to content
DysruptionHub
Sign in Subscribe

Hampton Regional Medical Center cyberattack disrupts patient care

Summary

Hampton Regional Medical Center logo

A July 2025 cyberattack disrupted patient-record access and care at Hampton Regional Medical Center. County officials confirmed patient diversions and impaired EMS coordination; later hospital findings dated unauthorized access to June 18–July 16.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Unresolved

Attack mechanisms

Data impacts

  • Unauthorized data access

    An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

  • Downstream organization impact

    The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.

Extortion indicators

  • Unknown extortion indicators

    The incident may involve extortion, but available evidence does not establish which extortion indicators were present.

Incident narrative

Analyst assessment

Hampton Regional Medical Center in Varnville, South Carolina, experienced a confirmed cyberattack that disrupted access to records and patient services in July 2025. The hospital’s September 12 notice places unauthorized system access between June 18 and July 16, with suspicious activity detected on or about July 16. The access window is not a finding that patient services were disrupted for that entire period.

Operational significance

WTOC’s July 24 reporting included patient accounts of unavailable records, a canceled visit and difficulty obtaining medication. The hospital acknowledged a cyber incident but provided little operational detail.

A July 25 county statement independently confirms effects on transfers and EMS coordination. Some patients went to alternative hospitals, extending ambulance turnaround. Hospital radio contact had returned after a temporary interruption; electronic exchange with EMS remained suspended. Emergency medical response continued, and the hospital still received patients for available services.

Confidence and uncertainty

The September notice confirms intrusion into hospital systems and identifies possible exposure of personal and medical information. It describes investigation, file review, notification planning and additional safeguards. It does not establish encryption, a completed data theft or actual publication. No independently verified actor attribution or ransom payment finding was located.

The court-authorized settlement FAQ describes a proposed $250,000 resolution of litigation concerning the incident. As of Oct. 24, 2026, approval remains pending, with a hearing scheduled for Jan. 25, 2027. The hospital denies the plaintiffs’ claims; settlement does not establish liability.

Analytic gaps

The intrusion’s initial access method, full data-review outcome, affected population and exact restoration date remain unestablished. No reviewed evidence confirms ransomware, encryption, a named actor, a ransom demand or payment.

Disruption is presumed resolved based on the time elapsed since the last verified continuing impact on July 25, 2025, and no subsequently verified ongoing outage. Complete restoration and its date remain unconfirmed. The limited restoration of radio contact does not prove all hospital systems recovered, and subsequent privacy notices or litigation do not extend the outage period.

Organizations involved

Impacted location

  • Varnville, South Carolina

    Varnville anchors the affected hospital campus. This does not imply town-government compromise or disruption throughout the municipality. County EMS effects are described in the narrative without inventing a hospital jurisdiction overlay.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.