Skip to content
DysruptionHub
Sign in Subscribe

REMSA Health dispatch cyber incident

Summary

REMSA Health logo

A February 2025 cyber incident temporarily disrupted REMSA Health’s computer-aided dispatch system. Staff used downtime procedures, while officials said ground ambulance and Care Flight patient care continued without delays. The system was restored by Feb. 11; exact intrusion and restoration dates remain unknown.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High

Attack mechanisms

  • Unknown cyber mechanism

    The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.

Data impacts

  • Unknown data impact

    The incident is cyber-related, but available evidence does not establish whether or how data was affected.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Application unavailable

    A specific application or software platform became unavailable or unusable.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • Unknown extortion indicators

    The incident may involve extortion, but available evidence does not establish which extortion indicators were present.

Incident narrative

Analyst assessment

REMSA Health’s computer-aided dispatch system was temporarily disrupted by a cyber incident in February 2025. In its statement to News 4–Fox 11, the organization confirmed the interruption and said the system had returned to operation by the Feb. 11 report. The exact intrusion and restoration dates were not established.

Operational significance

A Feb. 5 message from Chief Operating Officer Adam Heinz, quoted in the report, described security alerts affecting the isolated dispatch system. Employees were told to avoid computers while staff followed downtime procedures. The dispatch application’s loss and resulting workarounds establish a concrete operational consequence.

Public relations director Alexia Jobson said telephone services, other operations and patient care were unaffected. Ground ambulance and Care Flight services continued without delayed or adversely affected care, according to her statement. The record therefore distinguishes disrupted dispatch support from failure of the emergency response service.

Confidence and uncertainty

The organization’s direct public statement supports high confidence in cyber involvement and the limited operational disruption. Its earlier employee message was an internal communication; its Feb. 5 date is not treated as a verified public disclosure date.

REMSA Health is a private nonprofit emergency medical services organization. Its public-service role does not make it a county government department, and the incident does not establish an outage across its entire service territory.

Analytic gaps

The entry method, responsible actor, incident-specific costs and any data access or theft remain unverified. No matching ransomware claim was found under the organization’s name, domain or full legal name. Neither a security alert nor a law firm’s investigation announcement establishes ransomware or a data breach. Operational status is resolved on the organization’s restoration statement, while the exact end date remains unknown.

Organizations involved

Impacted location

  • Reno, Nevada

    Reno is REMSA Health’s verified physical operating municipality. News 4/Fox 11 reported the organization’s isolated computer-aided dispatch interruption while ground 911 and Care Flight care continued without adverse effects or delays. The city anchor does not imply citywide or countywide ambulance disruption.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.