NorthBay Health’s April 2024 IT disruption affected patient services and forced downtime procedures. A later notice confirmed unauthorized file access; ransomware and any payment remain unverified.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A public-facing website was unavailable, disabled, or inaccessible.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
NorthBay Health’s IT disruption affected patient services in Fairfield and Vacaville, California, in April 2024. The health system acknowledged a cybersecurity incident and said staff were caring for patients through downtime procedures.
NorthBay’s notice filed with Massachusetts regulators identifies suspicious network activity Feb. 23, 2024. Its investigation found unauthorized access to certain files between Jan. 11 and April 1. That access window is distinct from the later documented clinical disruption.
The notice says the information varied by individual. It may have included identity and financial information, medical and insurance information, biometrics, account credentials and payment-card details. NorthBay said it did not believe the information had been misused for identity theft or fraud and offered recipients two years of Experian credit monitoring. The sample leaves its mailing date blank.
Local reporting syndicated by KRDO documents a patient’s difficulty reaching the VacaValley walk-in X-ray service April 1 and her unsuccessful visit the following morning. Staff could not check her in or access her records. This is a specific interruption of access to care; it does not establish an emergency-department closure or patient injury.
Becker’s April 3 report quotes NorthBay’s April 2 acknowledgment, describes continuing restoration work and reports that its website was down. These effects concern the wider health system as well as VacaValley Hospital. The parent system and hospital remain distinct linked organizations.
Cyber involvement and operational disruption are well supported. SecurityWeek’s January 2025 report describes at least two weeks of disruption, but acknowledges that NorthBay did not specifically confirm ransomware. A shutdown alone cannot establish ransomware or a ransom payment.
The Record reported an Embargo claim. Its linked April 22, 2024, Hackmanac post says NorthBay had been listed on Embargo’s leak site and that the listing was later removed. The post includes an image naming northbay.org. This contradicts SecurityWeek’s statement that no group claimed the attack, but does not establish the actor’s responsibility, encryption or payment. Removal from a leak site is not evidence that a ransom was paid.
SecurityWeek attributes a count of 569,012 affected people to a Maine filing. Its one-year monitoring statement differs from the adult notice’s two-year offer; terms may differ among notices.
The entry method, exact application downtime, complete restoration date and any extortion remain unresolved. The incident remains presumed resolved with no verified end date. Later data notifications do not establish continuing clinical downtime. The notice is undated, and the earliest public chronology remains incomplete.
Hackmanac’s April 22, 2024, post reports an Embargo claim and removal of its leak-site listing. Its attached image names northbay.org. The Record links the same post. This is a third-party account, and the image’s April 2 timestamp has no stated time zone. The allegation does not establish Embargo’s responsibility, encryption, copied-data authenticity, ransom payment or an exact original claim date. Removal of a listing is not evidence of payment.
NorthBay Health is based in Fairfield, where its medical center forms part of the affected health system. Staff used downtime procedures during the IT disruption.
NorthBay’s affected hospital campuses are in Fairfield and Vacaville in Solano County. The reported clinical interruption involved VacaValley Hospital; this county relationship identifies the organizations’ physical setting.
NorthBay VacaValley Hospital in Vacaville was the site of the reported interruption to a patient’s walk-in X-ray visit.
Patient turned away from X-ray service because systems were unavailable.
NorthBay acknowledged a cybersecurity incident April2 and continuing systems restoration while caring for patients with downtime procedures.
Patient reported being unable to reach walk-in X-ray service April1, then turned away Tuesday because staff could not check her in or access records.
Hackmanac alleges Embargo compromise and says the leak-site post was removed; attached image names northbay.org.
Reports569012affected; acknowledgesNorthBaydidnotspecificallyconfirmransomware. Its payment inference is not independently supported.
Reports NorthBay breach and links a contemporaneous third-party report of an Embargo claim.
NorthBay confirms unauthorized file access Jan11–Apr1,2024, following suspiciousactivityidentifiedFeb23; affecteddata varies; no believed fraud or identitytheft.
Signed-in members can report an error, update, or missing source.
