US hospital reveals Christmas breach that exposed hundreds of thousands

Massachusetts-based Anna Jaques Hospital (AJH) fell victim to a cyber gang last year, leading to hundreds of thousands of patients having their data exposed.

The hospital has started distributing breach notification letters to the many victims of the cyberattack. According to data AJH submitted to the Maine Attorney General, over 316,000 people were impacted by the attack, which took place on Christmas day, 2023.

The Money Message ransomware cartel breached the company and supposedly stole 600GB of data. Since ransomware gangs try to cause damage by design, the hospital experienced disruption during the intensive festive season.

For example, the hospital's electronic records system was knocked out. Issues with ambulance service during Christmas were also interrupted.

AJH serves thousands of people in Merrimack Valley, North Shore, and Southern New Hampshire. The hospital employs nearly 5,000 physicians and 39,000 employees.

The breach notification letter indicated that AJH, together with external cybersecurity excerpts, conducted a lengthy investigation, which was finalized only in early November 2024. The organization did not reveal the extent of exposed data, only mentioning that names and other personal identifiers that may have been exposed.