John Z Black

John Z Black Apr 8, 2026 Incidents & Breaches #healthcare #hospital-cyberattack #ambulance-diversion #health-isac #ransomware #brockton-hospital

Ambulances rerouted. Chemo cancelled. Pharmacies can’t fill prescriptions. Electronic health records offline. Everything on paper.

Brockton Hospital detected suspicious activity Monday. By Tuesday, the 216-bed facility was in full downtime mode. Ambulances diverted to South Shore Hospital and Boston Medical Center South. Both activated surge plans.

Here’s the detail that stings: Brockton Hospital just reopened in August 2024 after an 18-month closure from an electrical fire. The community spent a year and a half without their hospital. Got it back. Now it’s crippled again.

The FBI is “aware.” No ransomware group has claimed credit. No determination yet on whether patient data was accessed.

But Brockton is just the visible one. Health ISAC CSO Errol Weiss describes a “sustained, high level of malicious activity targeting the healthcare sector” right now. Multiple undisclosed incidents hitting hospitals, payers, pharma companies, device manufacturers, and tech vendors simultaneously. The public count understates reality.

Health ISAC is tracking both Iranian state actors and financially motivated criminals operating in the sector at the same time. UMMC with 36 clinics hit by Medusa ransomware. Nacogdoches Memorial with 257,000 patient records exposed. An Idaho hospital dealing with its own incident. Separate attacks, separate groups, separate methods. The pattern is the volume.

A cancelled chemo appointment isn’t an IT inconvenience. It’s a patient whose treatment schedule just got disrupted during the most vulnerable period of their life. A closed pharmacy means someone can’t pick up medication they need today. Diverted ambulances mean longer transport times when minutes matter.

What you’re seeing in the news is a fraction of what’s actually happening.

Get the full picture on Brockton’s response, Health ISAC’s warning, and the sector-wide threat