Ascension Health Ransomware (May 2024): Black Basta Took Down 140 Hospitals

Incident summary

Ascension, one of the largest non-profit Catholic health systems in the US operating approximately 140 hospitals across 19 states and Washington DC, detected a ransomware attack on May 8, 2024. The incident took Ascension's electronic health record (EHR) systems offline across the network. The Epic EHR platform, which Ascension operates as its primary clinical documentation and order entry system, was unavailable to clinical staff for approximately six weeks. The EHR was fully restored on June 14, 2024 per Ascension's public statement of that date. During the downtime, Ascension reverted to paper-based documentation and order entry across affected hospitals.

Per Ascension's December 19, 2024 incident update, the initial access vector was an Ascension employee who inadvertently downloaded a malicious file to a corporate device. The update did not name the actor, but public reporting from May 2024 onward and CISA-FBI joint advisory AA24-131A, issued May 10, 2024, attributed the broader campaign category to Black Basta, a Russian-language ransomware-as-a-service group active since 2022 with documented healthcare-sector targeting. HHS HC3 issued a parallel Black Basta threat profile in mid-May 2024.

Patient safety impact during the EHR downtime was documented in public reporting from the Wall Street Journal, Associated Press, and trade publications. Specific reported incidents included medication errors due to paper-based order entry, delays in laboratory test results, ambulance diversions from affected emergency departments, and elective procedure postponements. Ascension nurses' union representatives at multiple affected hospitals publicly described safety concerns during the downtime. The patient-safety dimension of healthcare ransomware impact, while always present, was more visibly documented in the Ascension incident than in most prior healthcare ransomware events.

Attack technique

Per Ascension's December 2024 disclosure and CISA-FBI advisory AA24-131A on Black Basta TTPs, the technique chain began with phishing or malicious file delivery (T1566) and user execution of a malicious file (T1204.002) on a corporate device. The Ascension disclosure characterized this as an inadvertent employee action, which is consistent with the broader Black Basta affiliate pattern of using phishing and malvertising to deliver initial-access payloads. Common initial-access payloads in Black Basta operations include Qakbot, IcedID, and Pikabot, all of which fetch a Cobalt Strike beacon as the post-compromise framework.

Post-compromise, Black Basta affiliates use Cobalt Strike for command-and-control, then run reconnaissance with built-in Windows administrative tools and Active Directory queries. The affiliate playbook includes credential harvesting via Mimikatz, lateral movement via PsExec and WMI, and privilege escalation via known Active Directory misconfigurations. Persistence is established through scheduled tasks and service installations. The dwell time between initial access and ransomware deployment in Black Basta operations typically runs days to weeks, which gives defenders a detection window if the right telemetry and threat-hunting capability exist.

Ransomware deployment (T1486) is typically the final stage and runs during off-hours to maximize the encryption footprint before detection. Black Basta binaries disable volume shadow copies, modify backup catalogs, and where possible attempt to access and corrupt online backup repositories accessible from the compromised domain. The affiliate playbook also includes data exfiltration to attacker-controlled cloud storage prior to encryption (T1567.002), supporting the double-extortion business model where the actor demands ransom both for decryption and for non-publication of stolen data. Ascension has not publicly disclosed whether a ransom was paid or whether data was leaked on the Black Basta onion leak site.

The healthcare-sector targeting pattern of Black Basta and adjacent ransomware groups is operationally distinct from non-healthcare ransomware operations. Healthcare organizations have higher willingness to pay because of the immediate patient-safety consequences of EHR and clinical system downtime. The ransomware criminal market has documented this willingness and adjusted targeting accordingly. CISA-FBI advisory AA24-131A specifically called out healthcare sector targeting by Black Basta, and HHS HC3 issued parallel guidance in May 2024 on the healthcare-sector threat profile.

Impact and consequences

Patient-data impact reached approximately 5.6 million affected individuals per Ascension's June 2024 HHS Office for Civil Rights breach notification. The affected data categories included names, addresses, dates of birth, contact information, Social Security numbers for a subset of individuals, payment card data for a smaller subset, government identification numbers, and clinical and treatment information including medical record numbers and dates of service. The 5.6 million figure made the incident one of the largest healthcare ransomware breaches in 2024, second behind the Change Healthcare ALPHV intrusion in scope and ahead of most other healthcare ransomware victims for the year.

Operational impact during the six-week EHR downtime was severe. Ascension hospitals operated on paper-based clinical documentation and order entry, which is slower, more error-prone, and not scalable to high-volume emergency department and inpatient operations. Multiple Ascension hospitals diverted ambulances to nearby non-Ascension facilities during periods of the downtime. Elective procedures were postponed at affected hospitals. Pharmacy operations relied on paper-based medication reconciliation, which produced documented medication errors. Laboratory test result delivery was delayed, which produced documented diagnostic delays.

Financial impact was substantial. Ascension's Q3 fiscal year 2024 and full-year financial reporting recorded operational disruption from the cybersecurity event as a material item. The exact cost figure has not been publicly broken out, but Ascension's fiscal year 2024 operating loss expanded materially relative to prior-year expectations, with the cyber event cited as a contributing factor. The financial impact included direct remediation cost, lost revenue during the downtime, increased contractor and overtime labor cost, and the cost of patient notification and identity-monitoring services across 5.6 million affected individuals.

Regulatory and litigation consequence followed. HHS Office for Civil Rights opened a HIPAA breach investigation in June 2024. Multiple state attorneys general opened parallel investigations under state breach-notification and healthcare-data-protection laws. Class action litigation was filed in the weeks following the breach notification. The patient-safety dimension produced separate state department-of-health investigations at several Ascension state operations. The cumulative regulatory and litigation cost will extend through 2025 and beyond, with final settlement figures not expected until 2026 or later.

Indicators of Compromise

Specific artifacts defenders should hunt for. Cross-reference these against your existing detection rules before acting on them.

Lessons for defenders

Healthcare EHR availability is a patient-safety control, not just an IT availability control. Ascension's six-week EHR downtime produced documented patient-safety incidents. Build EHR availability protections accordingly: separate identity tiers for clinical system access, segmentation of clinical systems from corporate IT, offline backup tiers for clinical data, and tested business continuity procedures for paper-based fallback at scale. The Health Industry Cybersecurity Practices (HICP) reference documents from HHS and the 405(d) cybersecurity guidelines provide operational baselines for the healthcare sector specifically.

Initial access via phishing and malicious file delivery remains the dominant ransomware vector in healthcare. Ascension's disclosed initial access vector was an employee inadvertently downloading a malicious file. The realistic defensive posture is layered: phishing-resistant authentication that limits the impact of credential theft, endpoint protection capable of detecting Qakbot, IcedID, Pikabot, and equivalent initial-access loaders, and segmentation that limits lateral movement from a compromised employee endpoint. The CISA-FBI advisory AA24-131A indicator list provides specific detection material for Black Basta operations.

Backup integrity and offline backup tiers are the recovery control for healthcare ransomware. Black Basta binaries disable volume shadow copies and online backup catalogs as standard practice. Online backups accessible from compromised domain credentials are within the actor's reach. Offline, immutable, or air-gapped backup copies with independent authentication are the only reliable backup tier after a full domain compromise. Healthcare organizations relying solely on online backup tiers will experience full EHR downtime that runs weeks or months, as Ascension did. Invest in offline backup capability before the first incident.

Patient-safety incident documentation during EHR downtime should be pre-planned. Ascension's experience demonstrated that EHR downtime produces measurable patient-safety incidents. State health department investigations and litigation will require detailed documentation of those incidents. Pre-plan the incident documentation procedure for the downtime case: who records what, in what format, with what retention. The same pre-planning applies to ambulance diversion decisions, elective procedure postponement decisions, and pharmacy operations under paper-based fallback. Healthcare organizations that have not pre-planned these procedures will be making documentation decisions during the active incident, which is the worst possible time.

Related career roles

The cybersecurity professionals whose day-to-day work would have detected, investigated, or contained this incident.

• /careers/incident-responder
• /careers/soc-analyst
• /careers/healthcare-security-analyst
• /careers/threat-intelligence-analyst

Related Decipher Files

• Change Healthcare Ransomware (Feb 2024): ALPHV via Unprotected Citrix
• Halliburton Ransomware (Aug 2024): RansomHub Hit US Oilfield Services Giant
• Colonial Pipeline DarkSide: When OT Met Ransomware-as-a-Service

Frequently asked questions