Ransomware gang claims attack on California hospital that forced staff to use pen and paper

Ransomware gang Termite today claimed responsibility for a cyber attack on Watsonville Community Hospital in California.

The hospital reported an IT disruption on November 29, 2024 that forced it to shut down access to the internet, electronic health records, and prescription notifications. Staff reverted to pen-and-paper records, and the hospital’s homepage still displays a message about the disruption as of time of writing.

Watsonville Community Hospital has not verified Termite’s claim. We do not yet know what data might have been compromised, whether the hospital paid a ransom, how much Termite demanded, or how attackers breached the hospital’s network. Comparitech contacted Watsonville Community Hospital for comment and will update this article if we hear back.

On December 4, 2024, the hospital posted the following message on its site, which is still displayed at time of writing:

“We are experiencing a disruption of our computer systems. Our IT team, along with third-party IT specialists are working around the clock to restore systems to full functionality. In the meantime, we have implemented our standard downtime protocols, which essentially means we are operating on a paper system, including things like paper patient charting and paper prescriptions.”

Who is Termite?

Termite is a new ransomware gang that began posting attack targets on its leak site in November 2024. All of its attacks both steal data and lock down targeted systems, causing significant disruptions and downtime.

So far, Termite has claimed eight attacks. Four of those were confirmed by the targeted organizations.

Termite claimed confirmed attacks on Blue Yonder (a supply chain management company), Conseil Scolaire Viamonde (a French-language school in Canada), and Département de La Réunion (a French government council).

Ransomware attacks on US healthcare

Ransomware attacks on hospitals, clinics, and pharmacies can steal data and lock down computer systems used for everything from accessing medical records to bill payments. Providers might be forced to cancel appointments and switch to pen-and-paper processes until a ransom is paid to unlock their computer systems.

In 2024 so far, Comparitech researchers logged 136 confirmed ransomware attacks on US hospitals, clinics, pharmaceutical companies, and medical device manufacturers.

In other recent medical breach news, ransomware group Qilin claimed responsibility for an attack earlier this month on PrimaryPlus. Medical device maker Artivion is experiencing disruptions following a ransomware attack at time of writing. Finally, Ransomware gang BianLian claimed a September 2024 attack on Physicians Primary Care of Southwest Florida.

About Watsonville Community Hospital

Watsonville Community Hospital is a general hospital in Watsonville, California, south of San Jose. It employs 650 employees in a 106-bed facility.