Ransomware forced Micronesia's Yap health department offline

The Department of Health Services for Yap, one of the four states of the Federated States of Micronesia, reported that its network was hit by ransomware on March 11, 2025. The department's IT unit detected the attack at about 3 p.m. local time and pulled the entire network offline, shutting down computers to stop the malware spreading.

The shutdown cut internet connectivity, email running through the health servers and all digital health systems. Officials said patients could still be treated but that services were running more slowly while staff worked without electronic records.

The department published a breach notice on Facebook and said it was working with the FSM Department of Health and Social Affairs, other government agencies and private IT contractors to assess how far the intruders had reached, determine what data may have been taken and restore services. Yap's population was reported as roughly 12,000 by The Record and about 11,000 by Security Affairs.

No group had claimed responsibility as of mid-March 2025, and the department did not say whether a ransom had been demanded. The attack came about two weeks after a comparable ransomware incident at Palau's health ministry, part of a run of intrusions against Pacific island governments with limited security resources.