Claim details
March 27 local reporting attributed RansomHub identification to the then-CEO and reported an alleged 572 GB theft. This preserves the reported claim; no direct leak-post date or independently verified volume is available.
Whitman Hospital & Medical Clinics cyberattack
Summary
A cyberattack detected Feb. 28, 2025, disrupted Whitman Hospital & Medical Clinics in Washington. Electronic systems went offline, staff used paper workflows and appointments faced delays. Normal care was announced for March 11; IT and reimbursement recovery continued. Later notices described possible access to patient and health-plan files.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Healthcare operations disrupted
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Direct victim contact
The actor directly contacted the victim through a ransom note, email, chat portal, telephone call, messaging platform, or other communication channel.
Incident narrative
Analyst assessment
A cyberattack detected Feb. 28, 2025, disrupted Whitman Hospital & Medical Clinics in Colfax, Washington, and its outpatient clinics. The provider is operated by Whitman County Public Hospital District No. 3. Its later data-security notice established that unauthorized access to certain IT systems occurred between Dec. 26, 2024, and Feb. 28, 2025. That access window precedes the documented operational disruption.
WHMC began investigating, secured systems and engaged outside forensic specialists. Its March 3 official update confirmed that internal electronic systems remained unavailable and warned patients with appointments the next day to expect delays. The hospital and clinics continued providing care.
Operational significance
The hospital’s March 10 announcement said normal operations would resume March 11. This marks an announced return to routine care, rather than a verified date when every affected system and administrative process had recovered.
Whitman County Gazette’s March 27 account of a March 19 board meeting reported paper workflows during the shutdown and a phased restoration. Then-CEO Hank Hanigan described care returning within about a week, while IT and reimbursement work remained unfinished. Continued clinical access therefore coexisted with substantial workflow disruption and recovery work.
Confidence and uncertainty
Official acknowledgment and notices support high confidence in a disruptive cyber incident. Gazette reporting attributed the RansomHub identification to Hanigan and described the group’s alleged theft of 572 gigabytes. That volume remains an attacker allegation, rather than a verified measure of stolen data.
WHMC’s later notice said files containing patient and group-health-plan information may have been accessed or acquired. The information included identifying, financial, insurance and medical details. Notifications began April 11, 2025. This later finding supersedes the hospital’s early, provisional statements that it had no reason to believe patient information was compromised.
A settlement agreement filed in January 2026 established a $500,000 fund without an admission of wrongdoing. The court’s July 10 final approval order approved the settlement and reported notice to 57,631 class members. That litigation notice count is distinct from a verified count of records stolen, and the settlement is not a ransom payment.
Analytic gaps
The entry vector, independently verified theft volume, payment history, total response cost and exact completion date for all IT and administrative recovery remain unverified. Ransomware-lead searches using the provider’s name, domain, legal district name and WHMC abbreviation returned no matching listing; the separately reported RansomHub allegation remains relevant. The incident is assessed as presumed resolved, with no exact end date.
Threat actor and claim
Organizations involved
Whitman Hospital & Medical Clinics
Locations
Additional locations
Organization type
Critical infrastructure
Impacted locations
Colfax, Washington
Official Mar3 notice describes hospital/clinic electronic-system outage and appointment delays; original Gazette describes Colfax hospital paper workflows. Preserve Colfax site nexus without implying hospital closure.
Garfield, Washington
Official Mar3notice warns of delays at hospital or anyWHMCclinic; officialsite identifies Garfieldclinic. Meaningful affected-provider site anchor; no separately verified facility-specific downtime duration or closure.
St. John, Washington
Official Mar3notice warns of delays at hospital or anyWHMCclinic; officialsite identifies St. Johnclinic. Meaningful affected-provider site anchor; no separately verified facility-specific downtime duration or closure.
Tekoa, Washington
Official Mar3notice warns of delays at hospital or anyWHMCclinic; officialsite identifies Tekoaclinic. Meaningful affected-provider site anchor; no separately verified facility-specific downtime duration or closure.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.