The ALPHV ransomware group, also known as BlackCat, added Morrison Community Hospital to its dark web extortion site in October 2023. The facility is a critical access hospital in northwest Illinois.
The gang claimed it had taken about five terabytes of data covering patient and employee information, system backups and identity documents, and it published a sample as proof. Security Affairs reported that when the hospital did not give the attackers a clear response, they escalated by contacting journalists and threatening to begin calling patients directly.
Details of the underlying attack emerged later. According to HIPAA Journal, the attackers exfiltrated data and then encrypted files on the hospital's network on September 24, 2023. The hospital reported the breach to the U.S. Department of Health and Human Services Office for Civil Rights on November 23, 2023 as involving 122,488 current and former patients, with exposed information including names, dates of birth, addresses, Social Security numbers and medical information.
The stolen data was subsequently leaked when the ransom went unpaid. Morrison Community Hospital later agreed to pay $675,000 to resolve class action litigation filed in Illinois state court, denying wrongdoing but citing the cost of continued litigation.