Skip to content
DysruptionHub
Sign in Subscribe

Texas Tech health sciences cyberattack disrupts clinics and classes

Summary

Texas Tech University Health Sciences Center logo

A September 2024 cyberattack disrupted clinical services, communications and academic operations at Texas Tech’s health sciences universities in Lubbock and El Paso. Sensitive files were accessed or removed; Interlock’s responsibility remains unconfirmed.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Low
Attribution:
Low

Attack mechanisms

Data impacts

  • Unauthorized data access

    An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Intermittent service disruption

    Services or systems experienced recurring, unstable, or temporary periods of unavailability.

  • Email disruption

    Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Website unavailable

    A public-facing website was unavailable, disabled, or inaccessible.

  • Online portal unavailable

    A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Application unavailable

    A specific application or software platform became unavailable or unusable.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Scheduling disruption

    Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.

  • Healthcare operations disrupted

    Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.

  • Educational operations disrupted

    Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

  • Event or activity cancellation

    Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

  • Customer or public access restricted

    Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Data sample published

    The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.

  • Payment denied

    An authoritative source stated that no ransom or extortion payment was made.

Incident narrative

Analyst assessment

A September 2024 cyberattack disrupted clinical services and academic operations at Texas Tech University Health Sciences Center and the separately governed Texas Tech University Health Sciences Center El Paso. The institutions’ joint notice said investigators established access to or removal of files and folders between Sept. 17 and Sept. 29. The notice confirms a cyber incident and possible exposure of sensitive information; it does not establish that every affected file was stolen or that ransomware encrypted the systems.

Operational significance

In a Sept. 29 statement reproduced by KCBD, TTUHSC said students and employees could not access electronic resources. It announced limited clinical services and suspended academic operations for Sept. 30. Its following evening’s alert said on-campus academic operations would resume Oct. 1 while clinical operations remained limited.

An Oct. 2 patient-care update described intermittent phone outages, unavailable patient-portal communications and closed pharmacies. Patients needing refills were directed to visit their clinics with medication lists. Medical records could still be viewed through the portal at that point, although paper copies were unavailable. These conditions changed during recovery and should not be read as a uniform outage of every service.

In an Oct. 4 public update, Texas Tech Health El Paso said its clinical and educational operations were continuing with minimal interruption while associated systems and websites remained offline. The notice specifically identified effects on Texas Tech Physicians of El Paso and the university’s dental clinic. Later, El Paso patients interviewed by KFOX14/CBS4 on Oct. 16 reported difficulties obtaining prescriptions, appointments and procedures. Becker’s later account of an Oct. 25 update documented continuing fax, portal and telephone problems. Texas correctional health officials also reported lower October medical and dental encounter counts, while saying downtime procedures maintained continuity of care.

Confidence and uncertainty

Confidence is high in the cyber incident and documented disruption. El Paso’s Oct. 15 statement to KTSM explicitly acknowledged cyber involvement, preceding Interlock’s reported claim. Comparitech reported the claim and alleged stolen-data images, but the university had not verified them. Interlock’s responsibility, ransomware deployment and the claimed volume of stolen data remain unconfirmed.

Lubbock Lights’ reporting based on public records attributed approximately $2 million in costs, plus unquantified lost revenue, to the incident. It quoted the university system’s general counsel saying TTUHSC did not pay a ransom. Although some systems were shared with University Medical Center in Lubbock, that hospital’s separately reported ransomware incident, patient diversions and recovery dates do not establish corresponding facts about the health sciences centers.

Analytic gaps

The entry method, extent of any encryption, independently verified stolen-data volume and a current, deduplicated affected-person total remain unresolved. An April 2026 regulator filing concerns continued review and notification arising from the same September 2024 event; it does not establish a new attack or continued operational disruption.

The latest specifically dated operational problems in the reviewed reporting were on Nov. 14, 2024. The incident is presumed resolved, but an exact date of full restoration has not been established. Later notification, investigation and reporting dates do not extend the operational outage.

Threat actor and claim

Interlock

Listed as: Texas Tech University Health Sciences CenterSource: ransomware.liveDiscovered:

Claim details

Ransomware.live lists Texas Tech University Health Sciences Center under Interlock, matching ttuhsc.edu, with discovery recorded Oct. 27, 2024. The listing alleges possession of patient data, medical research and databases; Comparitech reported alleged sample images that the university had not verified. Responsibility, ransomware deployment, the claimed data volume and sample authenticity remain unconfirmed. Tracker discovery is distinct from the original posting and attack dates. No separate El Paso listing was found in bounded name/domain searches.

Organizations involved

Impacted locations

  • Abilene, Texas

    Abilene contains a TTUHSC academic site at 1674 Pine Street. The university reported institution-wide electronic-resource limitations and a suspension of academic operations for Sept. 30.

    Source

  • Amarillo, Texas

    Amarillo contains TTUHSC academic and clinical operations on South Coulter Street. The university reported institution-wide electronic-resource limitations and a suspension of academic operations for Sept. 30.

    Source

  • Dallas, Texas

    Dallas contains a TTUHSC academic site on Forest Park Road. The university reported institution-wide electronic-resource limitations and a suspension of academic operations for Sept. 30.

    Source

  • El Paso, Texas

    El Paso contains the separate university’s campus and clinical operations. The university acknowledged continuing cyber-related system disruption on Oct.15, and local patients subsequently reported care-access difficulties.

    Source

  • Lubbock, Texas

    Lubbock contains the university’s main campus and clinical operations affected by the September 2024 incident. The city association identifies the victim’s physical operating site.

    Source

  • Mansfield, Texas

    Mansfield contains a TTUHSC nursing instructional site on East Broad Street. The university reported institution-wide electronic-resource limitations and a suspension of academic operations for Sept. 30.

    Source

  • Midland, Texas

    Midland contains a TTUHSC instructional site on North Garfield Street. The university reported institution-wide electronic-resource limitations and a suspension of academic operations for Sept. 30.

    Source

  • Odessa, Texas

    Odessa contains TTUHSC academic and clinical operations on West Fourth Street. The university reported institution-wide electronic-resource limitations and a suspension of academic operations for Sept. 30.

    Source

Sources

Texas Tech Health Network Acknowledges Cyberattack After Weeks-Long IT Outage
DysruptionHubBy DysruptionHub StaffPublished: Retrieved:
  • Type: News Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: Medium

The article describes acknowledgment of a cyber incident after weeks of disruption to clinical and academic services. It reports patient difficulties obtaining prescriptions, appointments and procedures.

TTUHSC operations limited due to IT issue
KCBDBy News ReleasePublished: Retrieved:
  • Type: Official Statement
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

TTUHSC’s Sept. 29 statement said students and employees could not access electronic resources. It announced limited clinical services and suspended academic operations for Sept. 30.

UMC, TTUHSC still working through IT outages
KCBDBy Emma McSpaddenPublished: Retrieved:
  • Type: News Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

TTUHSC’s Sept. 30 alert said on-campus academic operations would resume Oct. 1 while clinical services remained limited. Electronic resources were still suspended during restoration work.

TTUHSC gives update on patient impact following IT outage
KCBDBy Shaley KidwellPublished: Retrieved:
  • Type: News Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The Oct. 2 update described limited clinics, intermittent phone outages, unavailable portal messaging and closed TTUHSC pharmacies. Patients needing refills were directed to visit their clinics with medication lists.

TTUHSC outage update and temporary student contacts
Texas Tech University Health Sciences CenterBy Texas Tech University Health Sciences CenterPublished: Retrieved:
  • Type: Social Post
  • Platform: Social Platform
  • Medium: Web Page
  • Confidence: High

The university’s outage notice described disruption to computer systems and applications. It provided temporary contact arrangements for students while normal electronic resources were unavailable.

Texas Tech Health El Paso Oct. 4 IT outage update
Texas Tech Health El PasoBy Texas Tech University Health Sciences Center El PasoPublished: Retrieved:
  • Type: Social Post
  • Platform: Social Platform
  • Medium: Web Page
  • Confidence: High

El Paso’s Oct. 4 notice said clinical and educational operations were continuing with minimal interruption while associated systems and websites remained offline. It identified effects on Texas Tech Physicians of El Paso and the university’s dental clinic.

Texas Tech Health El Paso says IT outage resulted from ‘cybersecurity event’
KTSMBy Dave BurgePublished: Retrieved:
  • Type: News Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

Texas Tech Health El Paso officials acknowledged a cybersecurity event and said investigation and restoration work were continuing. Their statement linked the event to the affected systems.

TTUHSC continues investigation into recent cyber security event
KFDABy Madison FisherPublished: Retrieved:
  • Type: News Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

University officials confirmed a cybersecurity event affecting computer systems, online functions and student processes. They said clinics and pharmacies remained open while coursework and clinical rotations were affected.

Texas Tech health network cyber attack disrupts patient care in El Paso
KFOX14/CBS4By Harrison ParkerPublished: Retrieved:
  • Type: News Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

El Paso patients told KFOX14/CBS4 they had difficulty obtaining prescriptions, appointments and procedures during the outage. The report described continuing care-access problems on Oct. 16.

IT outage persists for weeks at Texas health system
Becker's Hospital ReviewBy Giles BrucePublished: Retrieved:
  • Type: News Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: Medium

Becker’s reported continuing fax, portal and telephone limitations in an Oct. 25 university update. Clinics remained open and pharmacies were operating with limited capacity.

Ransomware gang claims cyber attack on Texas Tech University that cancelled classes
ComparitechBy Paul BischoffPublished: Retrieved:
  • Type: News Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: Medium

Comparitech reported that Interlock claimed responsibility for the university cyberattack and posted images of allegedly stolen information. It said the university had not verified the claim.

Correctional Managed Health Care Committee meeting minutes, March 5, 2025
Texas Department of Criminal JusticeBy Correctional Managed Health Care CommitteeRetrieved:
  • Type: Official Statement
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

University and correctional officials attributed lower October medical and dental encounter counts to the technology disruption. They said downtime procedures maintained continuity of care, while many remote mental-health providers retained electronic access.

Notice of a Cybersecurity Event and IT Outage Updates
Texas Tech University Health Sciences CenterBy Texas Tech University Health Sciences Center and Texas Tech University Health Sciences Center El PasoRetrieved:
  • Type: Official Statement
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The universities’ joint notice confirms a cyber event involving access to or removal of files between Sept. 17 and Sept. 29, 2024. It describes potential exposure of personal information that varies by individual.

TTUHSC El Paso notice of data event, Jan. 24, 2025
California Department of JusticeBy Texas Tech University Health Sciences Center El PasoRetrieved:
  • Type: Official Statement
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

El Paso’s notice describes the same Sept. 17–29 file-access window and potential exposure of personal information. It says affected information varied by recipient and offers protective services.

TTUHSC notice of data event to Maryland attorney general, Jan. 24, 2025
Maryland Office of the Attorney GeneralBy Gregory Lederman, counsel for Texas Tech University Health Sciences CenterRetrieved:
  • Type: Official Statement
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The university’s Maryland filing describes access to or removal of files between Sept. 17 and Sept. 29, 2024. It says review identified potentially affected personal information and explains individual notification.

TTUHSC notice of data event to Washington attorney general, April 9, 2026
Washington State Office of the Attorney GeneralBy Gregory Lederman, counsel for Texas Tech University Health Sciences CenterRetrieved:
  • Type: Official Statement
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The April 2026 filing concerns notification arising from the September 2024 incident and reports notices to 511 Washington residents. Its cover letter and sample notice give conflicting years for completion of the information review.

Interlock listing for Texas Tech University Health Sciences Center
ransomware.liveBy ransomware.liveRetrieved:
  • Type: Threat Actor Source
  • Platform: Website
  • Medium: Web Page
  • Confidence: Medium

The tracker lists the university under Interlock and describes alleged data associated with the claim. The listing does not independently verify the group’s responsibility or the authenticity of the information.

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.