Hospital systems went offline
Watsonville Community Hospital in California lost access to its computer network Nov. 29, 2024. Internet connectivity and systems used for patient charts and prescription notifications were disrupted. In initial reporting Dec. 2, hospital spokesperson Nancy Gere said staff had switched to paper charts and prescriptions while specialists investigated.
Care continued with delays
The hospital kept emergency, inpatient and outpatient services open. On Dec. 6, Gere confirmed a cyberattack and said the outage was continuing. Manual lab and X-ray requests slowed emergency services, with additional staff assigned to carry orders between departments.
In a Dec. 12 recovery report, Gere said internet access, electronic patient charts and prescription notifications were working again. Staff had added information recorded on paper to the electronic record system, and emergency services were operating normally. Systems had returned over the preceding days; the report did not establish one exact final restoration date.
Later investigation established data access
The hospital’s October 2025 notice identified unauthorized network access from Nov. 25 through Nov. 30, 2024, during which files were accessed or downloaded. A review of the affected files finished on or about Sept. 22, 2025.
Information varied by person and could include identifiers, medical and insurance information, financial details and account credentials. The hospital began notifying identified individuals. Its earlier statement that there was no indication of copying from the electronic health record system did not establish that medical information stored elsewhere was unaffected.
HHS’s public breach table lists a reported 30,312 affected people and a Dec. 31, 2024, submission date.
Attribution remains unconfirmed
Comparitech reported that Termite claimed the hospital on its leak site. DataBreaches.net also reported alleged data samples and a later release. The reviewed hospital notices do not authenticate those materials or confirm the group’s responsibility or ransomware encryption. The exact initial access method and a ransom demand or payment remain unverified in the reviewed primary evidence.
