University Medical Center Health System
Ransomware disrupts UMC Health System in Lubbock
Summary
UMC Health System in Lubbock, Texas, detected unusual activity Sept. 26, 2024, and diverted ambulance patients after ransomware made computer systems unavailable. Phone service, patient messaging, access to records and clinical workflows were disrupted while facilities continued providing care. Its investigation identified unauthorized access Sept. 16–26 and patient information in accessed or potentially taken files. Ambulance diversions had ended by an Oct. 23 update, although limited downtime remained. A November notice confirmed normal operations; the exact recovery date and attacker remain unverified.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Healthcare operations disrupted
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Downstream organization impact
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
UMC Health System in Lubbock, Texas, detected unusual activity Sept. 26, 2024, investigated and notified law enforcement. Its patient notice says an intruder accessed certain systems Sept. 16–26 and deployed ransomware that made some systems unavailable. This supports confirmed cyber involvement and high ransomware confidence. The initial access method remains unknown.
The notice identifies the affected group as Lubbock County Hospital District, doing business as University Medical Center and UMC Health & Wellness Hospital, UMC Physicians and affiliated entities. It reports access to, or possible taking of, files containing patient information. This is separate from the Texas Tech University Health Sciences Center incident; affiliation does not establish a shared intrusion or attacker.
Operational significance
UMC diverted incoming emergency and nonemergency ambulance patients to other facilities while keeping facilities open for care. Contemporaneous KCBD reporting distinguishes continued inpatient care and open clinics from the diversion of incoming patients. The Record described downtime procedures, delays, unavailable radiology systems at several clinics and instructions to bring prescription information because staff access to records was limited.
UMC’s Sept. 26 institutional post specifically reports intermittent phones and inability to process patient-portal messages. That does not establish loss of every portal function. TechTarget’s Oct. 1 report says patients could still view medical records online, although paper copies were unavailable; clinics remained open with possible delays.
Confidence and uncertainty
A KCBD recovery release published Oct. 7 reports electronic records restored across UMC locations and renewed MyTeamCare communication, while selected ambulance patients were still diverted and other systems were being restored. An Oct. 24 report reproducing UMC’s Wednesday update says diversions had ended, patient-facing appointment applications were back and electronic records were operating. A limited number of services still used downtime procedures on Oct. 23.
The original patient notice says normal operations had resumed. Its wording is corroborated by a news release published Nov. 22, supporting resolved status without an exact recovery date. Oct. 23 is the latest reviewed dated statement of continuing operational effects; Nov. 22 is a documented restoration bound, not the end date. The exact restoration date remains unknown.
The HHS breach archive lists 1,461,776 affected individuals in the district’s Nov. 22, 2024, report. Its closing summary identifies ransomware affecting clinical and demographic health information. The filing date and the report’s archive placement do not establish the end of the operational outage.
Analytic gaps
Patient names and varying combinations of contact, identity, insurance and treatment information were involved. An updated patient notice says the investigation finished Nov. 25, 2024, and describes files as accessed or taken. That wording does not establish theft of every affected record, publication, a ransom amount or payment. The investigation date does not establish continued operational downtime. No named operator is established. The generic University Medical Center REvil tracker entry discovered in June 2021 does not match this September 2024 event and is not used for attribution.
Sept. 26 is the earliest reviewed public outage date. An Avalanche-Journal report, marked updated that evening, attributes the ransomware explanation to UMC officials. This supports an acknowledgment by then, while the exact first institutional and external characterizations and their order remain uncertain. UMC directly documented service disruption, but the order of the earliest public cyber acknowledgments remains uncertain. The initial access method, precise recovery end and full site-by-site impact remain gaps.
Organizations involved
UMC Physicians
Locations
Additional locations
Organization type
Critical infrastructure
Impacted locations
Idalou, Texas
UMC Physicians’ September 2024 directory lists its Idalou clinic at 113 Walnut St. The affected clinic network relied on shared records and patient communication systems; effects at this individual site are not fully established.
Lubbock County, Texas
Lubbock County is the hospital district’s statutory service territory. This area identifies the affected district’s physical remit; effects on every resident or unrelated provider have not been established.
Lubbock, Texas
Lubbock contains University Medical Center, UMC Health & Wellness Hospital and UMC Physicians’ administrative offices and clinics. Documented clinical and technical effects varied across services.
Slaton, Texas
UMC Physicians’ September 2024 directory lists its Slaton clinic at 130 N. Seventh St. The affected clinic network relied on shared records and patient communication systems; effects at this individual site are not fully established.
Wolfforth, Texas
UMC Physicians’ September 2024 directory lists its Wolfforth clinic at 502 E. Highway 62/82. The affected clinic network relied on shared records and patient communication systems; effects at this individual site are not fully established.
Sources
We reported UMC Health System’s September 2024 ransomware incident, ambulance diversions and disruption of clinical computer access in Lubbock. The hospital system kept facilities open while using downtime procedures and restoring access.
Reports diversion of incoming ambulance patients during the UMC IT outage, with hospital facilities and physician clinics remaining open. Later updates describe phone and patient-message problems. Its current text does not establish the precise timing of the first public ransomware characterization.
UMC said phone service was intermittent across its system and staff could not process patient-portal messages. Patients needing prescription refills were directed to their pharmacy or primary care provider. The notice did not establish loss of every portal function.
The Sept. 26 report attributed UMC’s IT outage to ransomware, citing hospital officials. Incoming ambulance patients continued to be diverted while the hospital remained open.
Reports UMC’s ransomware acknowledgment, ambulance diversions and clinical downtime procedures. Staff lacked access to many patient records, radiology systems were unavailable at several clinics and patients were asked to bring prescription information. A complete restoration date was not available.
Describes ransomware-related ambulance diversions, intermittent phones and disrupted patient messaging. Clinics remained open with possible delays. Patients could still view records online, while paper copies were unavailable.
Reproduces UMC’s announcement that electronic health records were restored across its locations and patients could again communicate with UMC Physicians clinics through MyTeamCare. Selected ambulance patients were still being diverted while other systems were restored.
Reproduces UMC’s Oct. 23 update reporting that ambulance diversions had ended and electronic records and patient-facing appointment tools were operating. A limited number of services still used downtime procedures, so this was not confirmation of complete restoration.
Reproduces UMC’s notice describing Sept. 16–26 unauthorized access, ransomware and patient information in accessed or potentially taken files. The notice said normal operations had resumed and patient notification letters began Nov. 22.
UMC reported unauthorized access Sept. 16–26, ransomware deployment and involvement of patient information in accessed or potentially taken files. It said systems had been restored and normal operations resumed, and that patient letters began Nov. 22. It did not provide an exact recovery date.
HHS lists 1,461,776 individuals affected by the UMC Health System ransomware incident. The district submitted its report Nov. 22, 2024; the summary identifies clinical and demographic health information.
UMC said its investigation finished Nov. 25, 2024. It confirmed Sept. 16–26 unauthorized access, ransomware-related system unavailability, patient information in accessed or taken files, and restoration of normal operations. The notice also identifies UMC Physicians among the affected entities.
See something that needs correction?
Signed-in members can report an error, update, or missing source.