Metro Pet Vet and Manheim Pike ransomware incident

Analyst assessment

Our reporting and WGAL’s interview with owner and medical director Jeff Steed establish with high confidence that ransomware disrupted Metro Pet Vet and Manheim Pike Veterinary Hospital in January 2026. The ransomware blocked access to a shared server and patient records across the Manheim Pike, downtown Lancaster and Leola clinics.

Operational significance

Staff could not retrieve or update vaccine, medication and other patient histories. The clinics continued urgent and previously scheduled care using paper records and a scheduling app, but asked clients to limit calls while systems were unavailable.

The practice’s official notice said all locations were affected. Steed told WGAL that the compromised server did not store credit card or Social Security numbers, although it did contain client phone numbers and addresses. The public record does not establish that those records were accessed or stolen.

Confidence and uncertainty

Confidence is high that ransomware caused the records outage because the owner directly described ransomware being installed and the shared server becoming unavailable. No stable threat-actor or leak-site claim was located, and attribution remains unresolved.

Disclosure posture

Metro Pet Vet publicly described a cyberattack affecting all locations. The later owner interview provided the clearest public confirmation that the malware was ransomware and explained the manual workarounds.

Current status

The incident is presumed resolved. The practice expected temporary service limits to remain through the end of the week, and no continuing outage was located, but no final public all-clear established the precise restoration date.

Analytic gaps

The public record does not establish the initial access vector, vulnerability, malware family, threat actor, encryption scope, data-access or exfiltration scope, ransom demand or payment, law-enforcement involvement, restoration method or final recovery date.