PIH Health
PIH Health ransomware attack disrupts hospital systems
Summary
A December 2024 ransomware attack disrupted PIH Health’s clinical systems, communications and scheduling across Southern California. Recovery continued into February 2025, and the health system later notified individuals of unauthorized access to personal information.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Scheduling disruption
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
-
Healthcare operations disrupted
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
-
Event or activity cancellation
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Hospital and communications disruption
PIH Health identified a cyberattack Dec. 1, 2024, and took its network offline as a precaution. The disruption affected hospitals in Whittier, Downey and Los Angeles, along with other health system services.
ABC7 reported Dec. 4 that patients had trouble reaching doctors, scheduling systems were unavailable and some surgeries were canceled. Offices remained open, and patients with in-person appointments were asked to arrive early.
Reporting on PIH’s Dec. 4 update said emergency departments and urgent care centers continued operating while electronic health records, laboratory, pharmacy, radiology and registration systems were offline. Calls for Whittier and Downey were redirected to Good Samaritan Hospital. Staff used downtime procedures.
Recovery continued into February
By early January, PIH said hospital phone service had returned while clinical applications and other technology were being restored, according to Becker’s Jan. 6 report.
In its Feb. 5, 2025, update, PIH said phone lines, pharmacy refills, online scheduling and medical-record requests were operational. Patient portal appointments were available, but messaging and prescription renewals remained limited. The reviewed evidence does not establish when every service returned to normal.
Personal information findings and notification
PIH’s Feb. 27, 2026, notification letter said an unauthorized actor accessed information during the December 2024 incident.
In a March 6 company statement, PIH said it confirmed personal information in affected files Dec. 16, 2025, completed its data review and contact-information work Feb. 25, 2026, and notified identified individuals Feb. 27. Potentially affected information varied by person and included identity, medical and insurance information. The company reported no evidence of misuse at the time of that statement.
Ransomware and reported extortion
A PIH spokesperson described the incident as a criminal ransomware attack and said the FBI was involved, ABC7 reported Dec. 14.
That report also described an alleged demand letter threatening publication of confidential files. The attackers’ reported claim of 17 million records is not a verified count of affected people. The reviewed primary notices do not establish a final affected-person count, a named attacker, a ransom payment or an exact intrusion period.
Organizations involved
Impacted locations
Downey, California
PIH Health Downey Hospital’s clinical and communication systems were affected by the health system cyber incident. Its Brookshire Avenue address matches incorporated Downey in Census geography.
Los Angeles, California
Good Samaritan Hospital’s clinical systems were affected by the health system cyber incident. Its operating phone lines also received redirected calls for Whittier and Downey; this does not mean Good Samaritan’s own phones were offline.
Whittier, California
PIH Health Whittier Hospital and the corporate office are in Whittier. Hospital clinical systems and communications were disrupted. This identifies an affected organizational site in the city.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.