Rhysida Ransomware Attacks Five US Hospital Systems in Coordinated Campaign

Friday, March 13, 2026 at 05:00 AM UTC·Source: HHS HC3 / FBI

Updated: Saturday, March 14, 2026 at 06:00 PM UTC

Executive Summary

Rhysida ransomware group simultaneously attacks five US hospital systems, forcing ER diversions and surgical cancellations across 23 facilities.

Analysis

Rhysida launched coordinated attacks against five US hospital systems spanning 23 facilities across eight states. All attacks initiated within a 4-hour window via compromised VPN credentials. EHR systems, lab systems, and medical imaging all encrypted. Multiple hospitals diverted emergency patients to neighboring facilities. FBI and HHS are providing incident response assistance.

Timeline

Discovered

Mar 13, 2026

Exploitation Detected

Mar 13, 2026

Published

Mar 13, 2026

Source Attribution

Originally published by HHS HC3 / FBI on Mar 13, 2026. Verified by: HHS, FBI, CISA.

Related Threats

CRITICALRansomware

Cisco fixes critical IMC auth bypass present in many products

Cisco has released patches for a critical vulnerability in its out-of-band management solution, present in many of its servers and appliances. The flaw allows unauthenticated remote attackers to gain admin access to the Cisco Integrated Management Controller (IMC), which gives administrators remote control over servers even when the main OS is shut down. The vulnerability, tracked as CVE-2026-2009

CVE-2026-20093

12h agoCSO Online

HIGHRansomware

Akira ransomware group can achieve initial access to data encryption in less than an hour

A new report from Halcyon finds that the group also puts more effort than usual into developing working decryptors, likely to incentivize businesses to pay up. The post Akira ransomware group can achieve initial access to data encryption in less than an hour appeared first on CyberScoop .

18h agoCyberScoop

CRITICALRansomware

vSphere and BRICKSTORM Malware: A Defender's Guide

<div class="block-paragraph_advanced"><p>Written by: Stuart Carrera</p> <hr/></div> <div class="block-paragraph_advanced"><h3><span style="vertical-align: baseline;">Introduction</span><strong style="vertical-align: baseline;"> </strong></h3> <p><span style="vertical-align: baseline;">Building on </span><a href="https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign

CVE-2026-22769

20h agoMandiant