Analyst assessment
Ridgecrest Regional Hospital confirmed a cyber incident on Nov. 9, 2026, and said it proactively took systems offline to investigate. The Ridgecrest Daily Independent published the hospital’s statement amid a phone and computer outage. The acknowledgment establishes cyber involvement, while the initial access method and affected technical environment remain unknown.
ScarlettGroup listed the hospital’s rrh.org domain and claimed to possess patient, employee, payroll, clinical and financial records. In our Nov. 10 reporting, we documented the listing’s claimed record categories, apparent surveillance images and countdown labeled “Negotiation Deadline.” The claims and the images’ authenticity have not been independently verified, and the countdown does not establish that the hospital is negotiating. The tracker-derived claim report separately records discovery on Nov. 9; discovery does not establish the original publication time.
Operational significance
The confirmed effects include loss of normal telephone access and disruption to computer systems. In an outage update, the hospital supplied an alternate contact number and said calls could not be transferred internally. This documents degraded communications with departments and clinics; it does not establish canceled appointments, emergency department closure, ambulance diversion or loss of clinical records.
The hospital system’s Center Professional Pharmacy reported an internet outage that halted new prescription and refill processing and electronic payments. Customers notified that prescriptions were ready might still collect them using cash. The pharmacy did not identify the outage’s cause, so its notice does not independently establish the technical connection to the hospital’s cyber incident.
The affected organization is a private nonprofit hospital and integrated health system based in Ridgecrest, Kern County. Public communications about a system outage are operationally significant for access to hospital staff, but the available notices do not establish interruption to inpatient or emergency care, or effects at every affiliated clinic.
Current status
The hospital subsequently announced that its phone lines were restored and departments and clinics could again be reached through their usual numbers. That is affirmative partial recovery. The announcement addresses telephone access rather than confirming restoration of every computer system. As of Nov. 10, the hospital’s website still displayed an undated telephone and computer outage banner with the earlier alternate contact number. The banner’s lack of a timestamp leaves it unclear whether it reflected current conditions; it does not establish a renewed phone outage.
In a Nov. 9 afternoon update, the pharmacy said its software and electronic payments were working again, but phones remained down and staff were “WAY behind.” No estimate was given for clearing the prescription backlog. The hospital’s separate telephone-restoration announcement does not independently establish when the pharmacy’s remaining phone issues ended.
DysruptionHub assesses the incident as presumed active because a system shutdown was documented Nov. 9 and the subsequent recovery notice specifically restores phones. The pharmacy’s same-day backlog and limited recovery notices leave the remaining scope and duration of computer-system disruption unresolved. One day had elapsed since the last dated operational observation; this assessment does not imply continuing attacker access.
Confidence and uncertainty
Confidence is high that the hospital experienced a cyber incident with computer and telephone disruption because of its statement and official service notices. Ransomware involvement and ScarlettGroup attribution remain low confidence. The listing provides a detailed allegation and observable countdown pressure, not independent confirmation of a compromise mechanism or the claimant’s responsibility. Patient-data theft, surveillance access and any ransom demand received by the hospital remain unconfirmed.
Analytic gaps
The public record does not establish the intrusion vector, malware, encryption scope, clinical-system effects, data-access findings, the authenticity or capture dates of the apparent surveillance images, negotiations or method of restoration. A broader recovery statement and investigative findings are needed to determine the full operational duration and whether the claim corresponds to the hospital’s confirmed incident.
