Analyst assessment
Planned Parenthood of Montana experienced a confirmed cyberattack that led it to take parts of its network offline and later notify patients of stolen information. Its original notification letter says files were acquired between Aug. 24 and Aug. 28, 2024. Discovery occurred Aug. 28; the organization confirmed the copying of patient files on Sept. 6.
The network shutdowns establish an operational effect beyond the confidentiality breach. RansomHub claimed responsibility, but the organization’s acknowledgment of that claim does not confirm the group’s role. Reviewed primary evidence establishes unauthorized access and theft; incident-specific file encryption remains unverified.
Operational significance
CEO Martha Fuller described containment shutdowns and continuing system-restoration work in contemporaneous reporting. A Sept. 5 account also carried her statement that providers and health center staff were working to limit disruption while continuing patient care. These accounts do not establish a general clinic closure, diversion of patients or cancellation of all appointments.
Our Sept. 5 report described an unavailable online scheduling system and telephone or in-person appointment alternatives. That service interruption has not been independently corroborated in the available original statements. The chief executive confirmed that portions of the network were taken offline, with restoration work continuing in early September.
Confidence and uncertainty
Confidence is high in the cyberattack and patient-data theft, based on the victim’s notice. The compromised files could contain personal identifiers, insurance details and clinical information, with information varying by person. Later reporting gives conflicting affected-person totals: Comparitech reported 18,003, while The HIPAA Journal reported 56,917. A court order dated Jan. 26, 2026 describes 60,402 people as potentially affected. The order supplies a later litigation figure but does not reconcile the earlier totals or establish how many patients experienced interrupted care.
RansomHub attribution remains low confidence. BleepingComputer reported a listing, purported sample documents, a claimed 93 GB and a publication deadline. Those are extortion allegations, rather than independent proof of the claimed quantity, file authenticity or encryption. No reviewed evidence establishes payment, complete publication or a political motive.
Analytic gaps
The initial access method, precise operational scope and universal restoration date remain unknown. Sept. 5 is the latest verified contemporaneous account of continuing restoration in the reviewed record. The incident is presumed resolved based on elapsed time, with no exact end date asserted; later notifications and legal proceedings do not extend the operational disruption.
Judge Rod Souza of Montana’s 13th Judicial District Court granted final approval of the class-action settlement on Jan. 26, 2026, following a Dec. 15, 2025, hearing. The signed order directs entry of final judgment dismissing the action with prejudice and authorizes implementation of the settlement. It states that the settlement is not an admission of fault or liability. The order does not establish that benefits have been distributed or that every affected system was restored on a particular date.
