OneBlood
OneBlood ransomware incident
Summary
Ransomware slowed OneBlood’s blood processing and distribution in July 2024, forcing manual work and causing downstream surgery delays. Core blood operations returned to normal by Aug. 8. Later disclosures confirmed copied personal information and recorded incident losses and a ransomware payment.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
-
Data encryption
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Degraded service
Services remained available but with reduced performance, reliability, functionality, capacity, or responsiveness.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Scheduling disruption
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
-
Healthcare operations disrupted
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
-
Manufacturing or production disruption
Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.
-
Supply chain disruption
Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Backlog created
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
-
Third-party service disruption
The incident materially affected services delivered by or through a vendor, managed service provider, contractor, partner, or other third party.
-
Downstream organization impact
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
Extortion indicators
-
Payment reported
A source reported that the victim, insurer, intermediary, or another party made a ransom or extortion payment.
Incident narrative
Analyst assessment
OneBlood experienced a confirmed ransomware incident in July 2024 that impaired its blood-supply operations. Its Aug. 4 update described reduced-capacity software and continued manual labeling, while AP’s July 31 report documented the organization’s public acknowledgment and its request that hospital partners activate blood-shortage protocols.
The operational disruption was part of an event with an earlier unauthorized-access window. Reporting on OneBlood’s later breach notification quotes the organization as saying files were copied from July 14 through July 29. That finding establishes data theft separately from the blood-processing disruption; it does not establish that reduced blood distribution began July 14.
Operational significance
Manual collection, testing, labeling and distribution processes preserved some service but slowed the release of blood products. OneBlood said donor centers and mobile drives remained open. Its Aug. 6 notice reported restored critical software and near-normal output, and its Aug. 8 release confirmed normal blood processing and distribution without further supplemental shipments.
The disruption also reached patient care. Tallahassee Memorial HealthCare told WCTV that it rescheduled two complex elective surgeries to conserve blood and arranged another distributor. This is a documented downstream effect at an identified customer; it does not establish that every partner hospital postponed care or experienced a separate cyber intrusion.
Confidence and uncertainty
Ransomware confidence is high because OneBlood acknowledged it directly. Its audited financial report records about $12 million in incident losses and about $1.2 million in insurance recovery, and refers explicitly to a ransomware payment. The report does not separately state the exact ransom amount, recipient or payment date.
The later notification identified names and Social Security numbers in copied files. An August 2025 settlement agreement states that the incident involved access or potential access to private information belonging to 167,400 individuals. That figure does not establish that every listed person’s information was copied or that all donors’ records, medical histories or test results were stolen. Reports of VMware infrastructure encryption rely on an anonymous source, and no responsible operator is independently identified.
The agreement capped OneBlood’s total settlement obligation at $1 million, including class payments, administration, service awards and attorney fees. A Broward County circuit court order granted preliminary approval Aug. 21, 2025. OneBlood denied wrongdoing in the agreement. The settlement cap is separate from the financial report’s incident-loss figure; the records do not establish that the amounts represent wholly separate costs.
Analytic gaps
Core blood operations had recovered by Aug. 8, and OneBlood confirmed its rewards store was online Aug. 12. Its undated donor FAQ separately describes portal corrections and a temporary therapeutic-donation limitation. Those mixed-date entries leave the exact restoration of every ancillary service unclear; their planned completion date is not proof of completion.
The initial access method, full technical scope and individual hospital recovery dates remain unresolved. The Broward County clerk’s docket lists the settlement case as closed and records a final order dated Dec. 9, 2025. The order’s contents and actual settlement payments remain unverified. The evidence supports a resolved historical incident, with a qualified recovery timeline rather than an exact all-service end date. Later notification and financial reporting add findings about the 2024 event and do not establish renewed operational disruption.
Organizations involved
Tallahassee Memorial HealthCare
Locations
Organization type
Critical infrastructure
Impacted locations
Leon County, Florida
Leon County contains Tallahassee Memorial Hospital at 1300 Miccosukee Road. It postponed two elective surgeries because of OneBlood’s reduced blood supply; no separate intrusion into hospital systems is established.
Orange County, Florida
OneBlood’s headquarters and main donor center at 8669 Commodity Circle are in unincorporated Orange County, outside Orlando’s municipal boundary. This location does not establish countywide disruption.
Orlando, Florida
Orlando contains OneBlood donor centers, including its West Michigan Street location. The organization’s reduced capacity does not establish that this individual center was compromised or that the city experienced a general outage.
Tallahassee, Florida
Tallahassee Memorial Hospital is at 1300 Miccosukee Road in Tallahassee. It postponed two elective surgeries because of OneBlood’s reduced blood supply; no separate intrusion into hospital systems is established.
Sources
We reported reduced blood collection, testing and distribution after ransomware, manual processing and an urgent request for donors.
OneBlood confirmed ransomware and reduced capacity. A separate anonymous source described encryption of VMware infrastructure.
OneBlood publicly confirmed ransomware and reduced operating capacity, with manual processing and requests for hospital blood-shortage protocols.
A Tallahassee Memorial spokesperson confirmed two complex elective surgeries were rescheduled to conserve blood and an alternative distributor was arranged.
OneBlood said its ransomware event was affecting systems and delaying normal donation times, explaining a donor’s slower experience.
OneBlood said critical systems were operating at reduced capacity after reverification, manual blood labeling continued and electronic donor registration was beginning to return.
OneBlood reported critical operational software restored and near-normal blood processing and distribution. Manual labeling had slowed release of blood products while collection sites remained open.
OneBlood reported normal processing and distribution to more than 250 hospitals and said supplemental shipments were no longer needed.
OneBlood told a donor that the rewards store was back online and rewards could be redeemed.
The report quotes OneBlood’s January notification that files were copied without authorization July 14–29, 2024, and affected information included names and Social Security numbers.
The donor FAQ describes inaccurate portal eligibility and rewards information for late-July donations and says some therapeutic donations could not be processed.
Note 16 reports approximately $12 million in incident-related financial loss and $1.2 million in insurance recovery, referring explicitly to a ransomware payment.
The official docket lists case CACE25010397 as closed and records a five-page final order dated Dec. 9, 2025.
The Broward County circuit court granted preliminary approval of the OneBlood class action settlement Aug. 21, 2025, and appointed Kroll as administrator.
The parties’ August 2025 agreement describes access or potential access to private information of 167,400 individuals and caps the total settlement obligation at $1 million. OneBlood denies wrongdoing.
See something that needs correction?
Signed-in members can report an error, update, or missing source.