New York Blood Center
New York Blood Center ransomware disrupts blood services
Summary
A January 2025 ransomware attack disrupted New York Blood Center Enterprises and its divisions, forcing some blood-drive cancellations and slowing blood processing and distribution. Collection resumed before full service restoration. Later notices confirmed stolen donor and employee information.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Scheduling disruption
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
-
Healthcare operations disrupted
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
-
Supply chain disruption
Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.
-
Event or activity cancellation
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
A ransomware attack disrupted New York Blood Center Enterprises and its operating divisions, including New York Blood Center, in January 2025. A spokesperson confirmed the ransomware incident on Jan. 29, after suspicious IT activity was detected Jan. 26. The organization took systems offline, engaged cybersecurity specialists and notified law enforcement.
Operational significance
The incident canceled some blood drives, curtailed donation-center activities and slowed processing and order fulfillment. A Jan. 30 drive at Hotel Indigo in Riverhead, New York, was canceled. Appointments required rescheduling, and the provider warned that online schedules could lag behind actual changes. Hospital partners and other blood centers supported continuity through workarounds and additional blood supplies. The blood emergency declared Jan. 21 preceded the cyberattack; the incident added pressure to an existing shortage.
By Feb. 3, blood collection had resumed across the operating divisions, with donor centers and community drives proceeding and canceled drives being rescheduled. Normal distribution was still recovering. In its Feb. 5 update, AABB said processing had slowed, full service restoration was still progressing and its task force continued coordinating blood-product shipments. Resumed collection does not establish that every IT system or service was restored.
Confidence and uncertainty
Confidence that this was a disruptive ransomware incident is high, based on the provider’s explicit confirmation and contemporaneous operational reporting. The later original breach filing confirmed that an unauthorized party accessed the network and copied files between Jan. 20 and Jan. 26. Affected information varied: employee files could contain identity and direct-deposit information, while donor files could contain demographic, screening and infectious-disease test information. The filing reports Sept. 5 notification mailing to 2,996 Washington residents, a state-specific count.
A civil settlement agreement established a $500,000 non-reversionary fund covering administration, legal fees and other approved awards and benefits. A Minnesota court granted amended final approval in an order signed Feb. 19, 2026. The settlement is not a ransom payment or a measure of operational losses, and the order is not an admission of wrongdoing. Approval alone does not establish that individual payments were distributed.
Analytic gaps
The initial entry method, responsible group, encryption details and any ransom demand or payment remain unverified. Reviewed breach and settlement population figures have different scopes and have not been reconciled. The exact final service-restoration date remains unknown. Operational status is presumed resolved based on the elapsed time since the last verified continuing disruption on Feb. 5, 2025.
Organizations involved
Impacted location
New York City, New York
New York City is a verified physical operating location of the affected blood-services organization, including its Upper East Side donor center. The enterprise incident affected systems and blood services across operating divisions. This site-level city anchor does not establish a citywide outage or that every donor center canceled appointments.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.