UMMC Ransomware Closed 35 Clinics for Nine Days; Data Exposure Still Unconfirmed
The University of Mississippi Medical Center's 35 clinics reopened March 2 after a nine-day ransomware disruption that canceled appointments, chemotherapy, and elective procedures across the state. The Medusa ransomware group later claimed responsibility and demanded $800,000, but UMMC has not acknowledged the claim and has not confirmed whether any protected health information was accessed or removed. Under HIPAA rules, if UMMC determines that unsecured patient data for 500 or more people was compromised, formal breach notifications to individuals, federal regulators, and state media are required within 60 days of discovery.