Ascension ransomware and multi-week EHR downtime

Incident

Ascension ransomware and multi-week EHR downtime

8 May 2024United States (Ascension, 140 hospitals in multiple states)Fell to tier 2: manual operationConnectivity & data Human handoff Cascades

A ransomware attack took Ascension's electronic records offline for about five weeks. Clinicians told KFF Health News of medication errors and delayed lab results, and one said he had no training for the attack; Ascension said its care teams were trained for such disruptions.

Sources checked when written 26 September 2026

TierEHR and other clinical systems offline for about five weeks and care ran on paper, with barcode checks lost; loss of power or phones is not documented. How tiers are assigned.

What happened

Ascension detected the attack on 8 May 2024 and took systems offline; hospitals diverted ambulances and pharmacies were disrupted. EHR access was restored across the network by 14 June and Ascension declared full restoration on 20 June; data recorded during downtime was not immediately visible in the restored record. Clinicians in three states told KFF Health News of delayed or lost lab results, medication errors, and the loss of barcode checks. Specific reports included a patient who died after staff said they waited four hours for lab results that never came, and a patient given a narcotic meant for someone else who then needed a ventilator. Ascension did not confirm or dispute these accounts and said staff were trained for such disruptions.^[1,2]

Documented harm

Clinician-reported adverse events, including a death and a wrong-patient narcotic, reported by KFF Health News/NPR; not confirmed by Ascension or any regulator.

What it teaches

Paper workarounds built for hours do not hold for five weeks: order routing between departments breaks down.
Losing barcode medication administration removes a key independent check; plan manual double-checks for high-risk drugs.
Back-entering downtime data is its own risk period; the record stays incomplete after 'restoration'.
The paper fallback is only as good as the last time staff practised it.
Barcode and EHR safety checks disappear at tier 3; plan manual double-checks to replace them.

Sources

Cyberattack led to harrowing lapses at Ascension hospitals, clinicians say. KFF Health News (Rachana Pradhan) and Michigan Public (Kate Wells); co-published by NPR, 20 June 2024. Secondary Journalism · link checked 2026-09-26
The state-by-state impact of Ascension's cyberattack. Healthcare Dive, 2024. Secondary Journalism · link checked 2026-09-26

All incidents · Connectivity & data · Human handoff · Cascades

Information only, not advice. FailSystems is an aggregation and synthesis of published sources. It is not consulting, engineering, legal, regulatory or medical advice, and using it creates no professional relationship. Health systems are complex and no approach fits every organisation: anything you adopt is your own decision, at your own risk, and should be checked against the current official sources and by qualified people who know your setting. Full disclaimer.

Dealing with an incident right now? This site is a reference, not an incident-response service. Activate your organisation's emergency operations plan and incident command, and:

Life-threatening emergency: call 911.
Cyberattack or ransomware: report to CISA and the FBI field office near you (or IC3).
Power loss, disaster or resource needs: go through your local or county emergency management. They escalate to the state, and the state requests FEMA support; hospitals do not call FEMA directly.
A medical device problem: report it to the manufacturer and to FDA MedWatch.
Outside the US: your national emergency number and national cyber agency (in the UK, NCSC).

From Health 201FailSystems