UMMC Ransomware Attack and Statewide Clinic Closures

Analyst assessment

DysruptionHub assesses with high confidence that the University of Mississippi Medical Center experienced a ransomware attack beginning Feb. 19, 2026. UMMC called the event a cybersecurity attack in its first public statement and later confirmed that intruders demanded financial compensation to decrypt affected systems. Our initial Feb. 19 reporting documented widespread system outages, statewide clinic closures and canceled outpatient care.

Medusa claimed responsibility March 12, demanded $800,000 and posted images it described as samples of stolen UMMC documents. UMMC has not confirmed Medusa’s role or that data was stolen, so the actor relationship remains a medium-confidence claim rather than confirmed attribution.

Detection and containment

UMMC later said its monitoring detected irregular activity in the early hours of Feb. 19 as users began reporting problems. The organization shut down affected systems to contain the threat. UMMC said the incident was not caused by a single user error or someone clicking a malicious email, but it has not disclosed the initial-access mechanism.

Operational significance

The attack cut off access to Epic electronic health records and disrupted phone, email, Wi-Fi, website and other internal systems. UMMC closed all 35 clinics statewide, canceled outpatient and ambulatory surgeries and procedures, canceled imaging appointments, sent some staff home and used paper-based downtime procedures. The Jackson Medical Mall dialysis clinic continued scheduled care. Hospitals and emergency departments remained open, including facilities in Jackson, Grenada, Canton and Lexington, but UMMC temporarily diverted some transfers before resuming higher-level-care transfers Feb. 20. Staff made special arrangements for time-sensitive treatments, and chemotherapy restarted Feb. 23.

The disruption also affected organizations that depended on UMMC systems. Mississippi county health departments used paper charts while their UMMC electronic-record dependency was unavailable, although those departments remained open. UMMC later said all mission areas were affected and patient care was hit hardest. February revenue finished about 20% below budget, and the outage briefly delayed the Medical Center’s budget process.

Geographic scope

UMMC said all of its locations were affected. Its July 2025 statewide-presence map and facility directory support incident locations in 23 municipalities: Batesville, Bay St. Louis, Biloxi, Canton, Ecru, Flowood, Grenada, Gulfport, Hattiesburg, Iuka, Jackson, Lexington, Louisville, Madison, McComb, Meridian, Oxford, Ridgeland, Tupelo, Vaiden, Vicksburg, West and Winona. Multiple hospitals or clinics in the same municipality are represented by one deduplicated geographic record.

Extortion and data impact

UMMC said the attackers communicated directly and demanded payment in exchange for decrypting affected systems, independently confirming ransomware without relying on the later Medusa claim. Medusa’s listing added an alleged data-theft component, sample publication, a public leak threat and a deadline. Those actions establish extortion indicators but do not prove Medusa caused the intrusion or that its descriptions of the data were accurate.

As of UMMC’s April 27 public response, forensic work was still examining what data may have been accessed or exfiltrated. UMMC had not confirmed patient-data theft, Medusa attribution or whether any payment was made.

Confidence and uncertainty

Confidence is high that ransomware caused the disruption because UMMC described a payment demand for decryption and documented the resulting system outages. Confidence is also high in the organizationwide operational scope. Medusa attribution and alleged data theft remain medium-confidence claims because UMMC has not corroborated them.

Recovery and current status

UMMC said it was largely back to normal by Feb. 28. Clinics resumed normal operations and phone service returned March 2, with staff beginning to reschedule canceled appointments. Most systems used in regular operations were back online by March 13. The service-delivery disruption is resolved; the continuing forensic investigation does not make the incident operationally active.

Analytic gaps

The public record does not establish initial access, the precise ransomware variant, the full set of encrypted systems, the amount or categories of data allegedly stolen, whether a payment was made, Medusa’s actual role or the final notification population.