How did the Ascension ransomware attack start?

Ascension said its May 2024 ransomware attack began when an employee downloaded a malicious file onto a company device, thinking it was legitimate. Data of nearly 5.6 million people was stolen.

← All threat briefings

Healthcare · USA · 4 min read

Ascension: one 'honest mistake' download and 140 hospitals on paper

5.6M

people's data stolen

In May 2024, ransomware hit Ascension, one of the largest US health systems. Staff lost access to electronic patient records and went back to paper. Some ambulances were sent to other hospitals.

How it started

Ascension said an employee downloaded a malicious file onto a work device, believing it was legitimate. It called this an honest mistake.

The bill

Personal and health data of nearly 5.6 million patients and staff stolen.
Weeks of disrupted appointments, tests and prescriptions.
Two years of identity protection offered to everyone affected.

What to do this week

Teach staff that one download can be enough — no password needed.
Make it easy and blame-free to report a bad click fast.
Limit which devices and people can install or run new files.

Sources

BleepingComputer — employee downloaded malicious file
BleepingComputer — 5.6 million affected

Next breakdown

Supermarket freezers hacked: tens of millions of euros of food thrown away →