Skip to content
DysruptionHub
Sign in Subscribe

Taylor Regional Hospital uses paper charts after cyberattack

Summary

Taylor Regional Hospital logo

Taylor Regional Hospital in Hawkinsville, Georgia, used paper charts after discovering an attempted ransomware attack in December 2024. Care continued; a later INC theft claim remained unverified.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Unresolved
Attribution:
Unresolved

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

Data impacts

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Data sample published

    The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.

Incident narrative

What happened

Taylor Regional Hospital in Hawkinsville, Georgia, discovered an attempted ransomware attack on the morning of Dec. 12, 2024. Georgia Hospital Association official Anna Adams confirmed the incident to 13WMAZ.

Service disruption

Staff switched to paper charts while addressing the digital disruption. Adams said the hospital remained open and continued treating patients.

Data impact and attribution

Adams initially said investigators had found no evidence of data access or exposure of patient records, while emphasizing that the investigation continued.

INC later claimed responsibility and posted images it described as stolen hospital documents, Comparitech reported in January 2025. The hospital had not verified that claim at the time of the report. The allegedly stolen contents, ransom amount and any payment remain unconfirmed in the reviewed sources.

Response and recovery

The hospital isolated the affected systems and worked with law enforcement and its cybersecurity insurance company, Adams said. Paper charts provided a workaround during the response. The reviewed reporting does not establish a final restoration date.

Threat actor and claim

INC Ransom

Listed as: Taylor Regional Hospital (thcg.local)Source: ransomware.liveDiscovered:

Claim details

INC Ransom claimed the Georgia hospital and posted images described as stolen documents, according to Comparitech’s Jan. 17, 2025, report. The hospital had not verified the claim. The tracker observed the listing at the timestamp recorded here; it does not establish the original actor-post time or attack date. Alleged sample contents, exfiltration, ransom amount and payment remain unverified. The earlier named association official’s report of an attempted ransomware attack does not establish that INC caused it or successfully encrypted files.

Organizations involved

Impacted location

  • Hawkinsville, Georgia

    Hawkinsville contains the affected private hospital and its paper-chart workaround. This city-level physical anchor does not establish a city-government victim, a countywide outage or closure of the hospital.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.