A July 2025 ransomware incident at Susan B. Allen Memorial Hospital disrupted appointment access in El Dorado and phone service at its Augusta clinic. The hospital later notified potentially affected individuals; Kawa4096 attribution and its alleged stolen-data volume remain unconfirmed.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
Susan B. Allen Memorial Hospital experienced a confirmed ransomware incident in July 2025. Its later notice dates the incident to July 2–14 and says potentially affected information included identifying, insurance and medical data. This strengthens the initial assessment in our July 18 reporting, which described suspected cyber activity and an IT outage.
The hospital’s anomalous-network-activity statement, reported by KWCH on July 17, is the earliest verified public cyber evidence. Its July 16 clinic post disclosed telephone problems without identifying a cyber cause.
The outage impaired access to appointment scheduling at the El Dorado hospital, according to patient reports carried by KWCH. The hospital separately confirmed that its Augusta Immediate Care Clinic lost telephone service while remaining open. These are concrete effects on access to care; the evidence does not establish a hospital closure, ambulance diversion or interruption to every clinical service.
Confidence is high in the cyber and ransomware assessments because the hospital itself later identified ransomware. Confidence in Kawa4096 responsibility remains low: a Ransomware.live listing names the hospital’s domain, while Comparitech reported the group’s allegation of 210 GB stolen and purported document samples. The hospital has not independently confirmed that attribution, volume or sample authenticity in the reviewed record.
Potential compromise of personal information is supported by the hospital’s notice; verified exfiltration scope remains unresolved. The court-authorized settlement site describes alleged file access and a proposed settlement, while recording the hospital’s denial of wrongdoing. It does not establish liability or prove the actor’s theft claim.
The public record does not establish initial access, compromised accounts, encryption extent, ransom terms, payment, or a complete restoration date. July 17 is the latest precisely dated operational-impact observation verified here. Operational disruption is presumed resolved because of the elapsed time, with no invented end date; later notifications and litigation do not establish continuing outage.
The hospital says notification letters were mailed Feb. 18, 2026. As of Oct. 24, 2026, the proposed settlement’s final approval hearing is scheduled for Dec. 7. Neither date is used as the attack onset, original notice publication date or recovery date.
External listing names sbamh.org as a kawa4096 victim. Discovery was July 22, 2025; original publication is unknown. Comparitech reported alleged theft of 210 GB and purported samples, neither independently authenticated by the hospital.
The hospital’s Augusta Immediate Care Clinic experienced a telephone outage while remaining open. This municipality identifies the affected clinic’s location and does not imply citywide or countywide disruption.
Susan B. Allen Memorial Hospital in El Dorado experienced an IT outage with reported difficulty accessing appointment scheduling. This municipality identifies the hospital location and does not imply that city government or all local health services were disrupted.
Our July 18 report described anomalous network activity and an IT outage at Susan B. Allen Memorial Hospital. Patients reported difficulty contacting the hospital to schedule critical appointments.
The hospital’s July 16 post says its Augusta Immediate Care Clinic remained open while telephone lines were unavailable. The attached image repeats the phone outage and continued clinic availability.
The hospital said anomalous activity on its network led to an IT outage and that a cybersecurity team was investigating. Patients reported being unable to contact the hospital to schedule critical appointments.
The court-authorized settlement site describes allegations that files containing private information were accessed during the July 2025 attack. The hospital denies wrongdoing, and final approval is scheduled for December 7, 2026.
The external victim listing identifies sbamh.org and the group kawa4096. Its discovery timestamp is July 22, 2025 at 04:50:42 UTC.
A report visibly updated July 23, 2025 says Kawa4096 claimed the hospital the previous day, alleged theft of 210 GB and posted purported employee and patient documents. It notes the hospital had not confirmed the claim.
The hospital identifies ransomware, dates the forensic incident window to July 2–14, 2025, and says letters were mailed February 18, 2026. Potentially affected information varies by individual and includes identity, insurance and medical data.
Signed-in members can report an error, update, or missing source.
