Ransomware at the hospital: cyber readiness for every clinic
When a health system's computers go down, appointments, records and phone lines go with them — and scammers move in. Smaller providers face the same risks with fewer resources.
By the Xuru Technologies team · 23 May 2025
Key takeaways
- On 20 May 2025 a cyberattack caused a system-wide technology outage at Kettering Health, which runs 14 medical centres in Ohio.
- Elective procedures were cancelled and call centres disrupted while systems were restored.
- Scammers called patients pretending to be from the health system, seeking payment details.
- Clinics need backups, offline procedures and clear patient communication plans.
Healthcare is a favourite target for ransomware because downtime is so painful. Private clinics, dental practices and therapy centres are not too small to be hit.
What happened
TechTarget reported the system-wide outage and the cancellation of inpatient and outpatient procedures. Kettering Health also warned patients about scam calls, as Bitdefender highlighted.
What it means for clinics
- Bookings and records are critical systems. Know how you'd operate if they were unavailable for days.
- Patients become targets. Tell them how you contact them and that you never ask for card details by phone.
- Suppliers hold your data. Booking, records and billing providers need strong security too.
- Your website is a lifeline for status updates during an incident.
Clinic cyber readiness checklist
| Control | Detail |
|---|---|
| 2-step login | On email, booking, records and website admin |
| Backups | Daily, off-site, tested restores |
| Offline day sheet | Print or download tomorrow's appointments each evening |
| Patient notice | "We will never ask for payment details by phone" on your website |
| Incident contacts | IT partner, insurer and regulator details in one place |
Frequently asked questions
Are small clinics targeted by ransomware?
Yes. Attackers often exploit weak passwords or unpatched systems regardless of size, and healthcare data is valuable.
Should a clinic website show incident updates?
Yes. A simple status banner telling patients what is affected and how to reach you reduces confusion and scam risk.
What should we do first after an attack?
Isolate affected systems, call your IT support and insurer, preserve evidence and follow your regulator's reporting rules.
Protect patients online and offline.
Secure booking, 2-step admin logins, backups and incident-ready status messages for healthcare providers.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply