Skip to content
DysruptionHub
Sign in Subscribe

Southern Oregon Veterinary Specialty Center ransomware incident

Summary

Southern Oregon Veterinary Specialty Center logo

Southern Oregon Veterinary Specialty Center temporarily closed urgent care and limited emergency services after staff encountered locked records and a ransom demand in November 2024.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
High
Attribution:
Low

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

Data impacts

  • Data encryption

    Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Healthcare operations disrupted

    Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Backlog created

    The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • Ransom demand

    The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

  • Encryption-based extortion

    The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Veterinary care disrupted

Staff at Southern Oregon Veterinary Specialty Center discovered inaccessible patient files and a payment demand on Nov. 9, 2024. Director Craig Lassen told KDRV that the center shut its networks and replaced about 30 devices. In the station’s original video interview, he described a note claiming the files were encrypted.

Urgent care closed, emergency capacity fell, and some animals faced delays or referral elsewhere. Protected external storage helped staff recover records access. The report described continuing work on computer access and delayed care; its recovery forecast was not an observed completion date.

Data and attribution

The center told KDRV that client payment information was not at risk. That statement does not resolve every possible data exposure. Data theft, a payment, an intrusion method and an exact end date remain unverified.

Ransomware.live recorded a Monti claim for the center’s name and sovsc.com on Nov. 19, 2024. That observation is not the original posting time or the attack date. The operator interview supports the incident independently of the unconfirmed actor allegation.

Recovery assessment

The center’s current website advertises emergency, urgent and specialty care. The incident is presumed resolved because the last specifically dated operational difficulties were reported Nov. 11, 2024, well before this review. The current schedule does not establish when every affected system or care backlog recovered.

Threat actor and claim

monti

Listed as: Southern Oregon Veterinary Specialty CenterSource: ransomware.liveDiscovered:

Claim details

Ransomware.live lists Southern Oregon Veterinary Specialty Center and sovsc.com under Monti, observed Nov. 19, 2024. The tracker observation is not a verified original posting time or attack date. The operator’s original interview independently confirms the ransomware incident, but it does not identify Monti. Attribution, theft, data volume, a payment and any specific access method remain unverified. Other trackers’ Nov. 9 dates and speculative personal-data categories are not adopted.

Organizations involved

Impacted location

  • Central Point, Oregon

    Unresolved Confidence

    Retain the existing Central Point relationship while the exact physical jurisdiction of 4901 Biddle Road is checked. The hospital’s care restrictions are independently reported, but the postal address does not establish incorporated-city containment or a citywide outage. No new facility location or private hospital service-area polygon is proposed.

Sources

Cyber attack halts some animal hospital operations
KDRV NewsWatch12By Rocky WalkerPublished: Retrieved:
  • Type: News Report
  • Stance: Confirm
  • Platform: Video Platform
  • Medium: Video
  • Confidence: High

Original captions show the director describing a ransom note that claimed encryption of files.

Cyber attack halts some local animal hospital operations
KDRV NewsWatch12By Rocky WalkerPublished: Retrieved:
  • Type: News Report
  • Stance: Confirm
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The director described network isolation, replaced devices, an urgent-care closure, reduced emergency capacity and ongoing recovery after staff encountered a ransom demand.

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.