Memorial Hospital and Manor notified 120,085 people after ransomware attack

Memorial Hospital and Manor, an 80-bed community hospital and 107-bed long-term care facility in Bainbridge, Georgia, began sending breach notification letters on February 7, 2025 to 120,085 people whose information was taken in a ransomware attack the previous November.

The attack was detected on November 2, 2024, after staff lost access to the electronic medical record system, email and the hospital's website. The hospital posted a notice on its Facebook page the following day and switched to manual, paper-based record keeping while systems were unavailable. Its review of the affected files was completed on January 31, 2025.

The data involved included names, dates of birth, Social Security numbers, health insurance information, medical treatment information and medical histories. According to Infosecurity Magazine, the Embargo ransomware group claimed the attack and said it had taken 1.15 terabytes of data, which it threatened to publish on its Tor leak site. The hospital reported the breach to the US Department of Health and Human Services Office for Civil Rights and to the Maine Attorney General's office.

Memorial Hospital and Manor said it had put additional security measures in place and offered those notified 12 months of complimentary credit monitoring, stating it had no evidence that the information had been misused. The hospital later agreed to settle a consolidated class action brought over the breach, with a final fairness hearing set for January 2026.