UMMC Ransomware Attack and Lessons Learned

The UMMC ransomware attack teaches small practices to prepare before an attack hits. Test that your backups actually restore. Print your downtime procedures. Write an incident response plan, limit access, and turn on multi-factor authentication. On February 19, 2026, the attack closed all 35 UMMC clinics. They did not return to normal until March 2.

On February 19, 2026, staff at the University of Mississippi Medical Center found their computers useless. The Epic electronic health record (EHR) system was down. It is the backbone of patient care at one of Mississippi’s largest health care systems. That day, UMMC closed all 35 of its clinics statewide. Elective procedures were canceled.

Doctors pulled out paper forms they hadn’t touched in years. Emergency rooms stayed open, and nurses charted patient care on paper. Mississippi’s only academic medical center, serving one of the nation’s poorest and sickest populations, had been brought to its knees by a ransomware attack.

This wasn’t a small community clinic. UMMC has a $2 billion budget. That is about two percent of Mississippi’s whole economy, according to CNN. If ransomware can shut them down, it can shut down anyone.

What Happened During the UMMC Cyberattack

The attack hit on February 19. Attackers got into UMMC’s computer network, and Epic went offline. To be safe, UMMC shut down all of its IT systems. Doctors switched to pen and paper.

Dr. LouAnn Woodward, a UMMC vice chancellor, told reporters: “The attackers have communicated to us and we’re working with the authorities and the specialists on next steps.” In its early statements, UMMC did not name the ransomware gang. It also did not say whether it considered paying.

The FBI said it was “surging resources both locally and nationally.” Federal health officials also kept a close watch on the damage. That’s not a sign things are going smoothly. It’s a sign the attack was serious enough to require federal resources.

By February 25, a full week after the attack, clinics were still closed and elective procedures were still canceled. UMMC’s IT team worked around the clock to get the network back online. The clinics finally returned to normal operations on March 2, 2026, according to UMMC.

For Mississippi’s most at risk patients (children with complex conditions, dialysis patients, rural residents who drove hours for specialist appointments), that’s not an inconvenience. That’s a healthcare crisis. During the downtime, UMMC staff contacted patients who needed urgent care to schedule clinic visits.

Timeline of Events

Why Healthcare Is a Top Target for Ransomware Attacks

Ransomware gangs target healthcare for two specific reasons.

First, medical records are worth more on the black market than many other data types. A stolen Social Security number can sell for just a few dollars. A complete medical record, with insurance information, diagnoses, Social Security number, and personal details, is worth far more to criminals. And the attacks keep coming. In 2025, at least 710 healthcare breaches were reported to HHS. Each one affected 500 or more people.

Second, hospitals and clinics can’t afford downtime. A retailer that gets hit can survive being offline for a few days. A dialysis clinic cannot. An oncology practice cannot.

Attackers know this, and they set their ransom demands to match. In 2025, healthcare providers faced 445 ransomware attacks. The average ransom demand against them was $615,000. Those figures come from Comparitech data reported by Compudent.

FBI reports have listed healthcare again and again among the hardest-hit sectors. (The FBI groups these essential services as critical infrastructure.) And smaller practices are hit often. Many of them have weaker security and no dedicated IT team.

The Uncomfortable Truth: UMMC Had More Resources Than Your Practice

Here’s what makes this story terrifying for small practices. UMMC is Mississippi’s only academic medical center (a teaching hospital system). It has its own IT division. They had downtime procedures in place: plans for working without computers.

And they still lost their electronic records for over a week. Their clinics did not return to normal operations until March 2.

Your practice, if you’re a small-to-midsize operation, almost certainly has fewer resources. Less IT staff. No contacts at federal cybersecurity agencies. Probably a thinner incident response plan, if you have one at all.

That’s not a criticism. It’s the reality of healthcare in 2026. The same kinds of weak spots attackers look for exist in clinics everywhere, and the attackers know exactly which targets are easier.

Lessons for Smaller Practices

1. Backup testing matters more than backup existence. Having backups is not protection if you have never tested restoring from them. HIPAA's contingency plan standard under 45 CFR 164.308(a)(7) lists "testing and revision procedures" (checking and updating your plan) as an "addressable" item. Addressable means you decide if it is reasonable and appropriate for your practice. If it is, you do it. If it is not, you write down why. Then you use a reasonable alternative if one fits. UMMC's recovery timeline shows what happens when restoration is not fast or clean.
2. Downtime procedures must be written, printed, and practiced. UMMC had downtime procedures in place, so staff could fall back to paper. Many small practices do not. If your EHR goes down tomorrow, your staff needs printed instructions for patient care, medication lists, and appointments. Keep them stored somewhere they can reach without network access.
3. Incident response plans cannot be created during an incident. Under 45 CFR 164.308(a)(6), covered entities must implement policies and procedures for security incidents. Your plan should name who to call (IT vendor, cyber insurer, FBI IC3, CISA), what to disconnect, and who makes decisions, all documented before an attack happens.
4. Access controls determine blast radius. The more systems accessible from a single compromised account, the more damage ransomware does. Under 45 CFR 164.312(a)(1), covered entities must implement technical policies to allow access only to authorized persons. Least-privilege access and network segmentation limit how far an attacker can spread.
5. Multi-factor authentication blocks a common way in. Many ransomware attacks start with stolen passwords or phishing emails (fake emails that trick staff). Turn on MFA (a second login check, like a code on your phone) for your EHR, email, and remote access systems. That closes off this path, often at little or no cost.
6. Small practices are targets too. In 2025, HHS got reports of 710 breaches that each affected 500 or more people. Of those, 455 affected fewer than 10,000 people. The same tactics used against UMMC can work even faster against a five-person clinic with no security staff.
7. Prevention usually costs less than recovery. A compliance program with risk assessment tracking, tested backups, MFA, and staff training usually costs far less than a single ransomware recovery costs in downtime, breach notification, and patient impact.

Could This Happen to You?

Answer these questions honestly. If you answer "no" or "I don't know" to more than two, your practice has the same gaps that ransomware exploits.

• Have you updated your risk analysis (a written check of the risks to your patient data) in the past 12 months? It is required by 45 CFR 164.308(a)(1). (The current rule sets no yearly deadline. Once a year is still a sensible pace.)
• Have you tested restoring your EHR and patient data from backup in the past 6 months?
• Is multi-factor authentication enabled on your EHR, email, and all remote access systems?
• Do you have a written incident response plan that names specific people, phone numbers, and steps, not just a generic policy?
• Do you have printed downtime procedures your staff can follow if the network goes completely offline?
• Have your staff received phishing awareness training in the past 12 months, with records showing who finished it? (45 CFR 164.308(a)(5) requires a security awareness and training program.)
• Do you know who to call first if ransomware hits: your IT vendor, your cyber insurer, and the FBI's IC3 (ic3.gov)?

How to Protect Your Healthcare Practice from Ransomware

The UMMC attack is sobering, but it’s not a reason to freeze. It’s a reason to get specific about your defenses. Here’s what actually moves the needle.

1. Conduct a Real HIPAA Risk Analysis

This isn’t a checkbox exercise you hand to a consultant and forget about. A proper HIPAA Security Rule risk analysis identifies exactly where your ePHI lives, who can access it, and what would happen if your systems went offline today.

OCR is the HHS office that enforces HIPAA. Many of its enforcement actions in 2025 involved a missing or weak risk analysis. The proposed HIPAA Security Rule update would require this review every 12 months. It is a proposal from January 2025, not law yet. Getting ahead of it protects you twice: from attackers and from regulators.

2. Test Your Backups Using the 3-2-1 Rule

Having backups is not the same as having working backups. Follow the 3-2-1 rule: three copies of your data, on two different media types, with one copy stored offsite and air-gapped (completely disconnected from your network).

UMMC’s situation could have been very different if they could restore from a clean, verified backup within hours. Your last backup should be recent, your restoration process should be tested quarterly, and your offsite copy should be something ransomware can’t reach and encrypt.

3. Implement Multi-Factor Authentication (MFA) Everywhere

MFA would become required under HIPAA’s proposed Security Rule update. That proposal is not final. Today’s rule does not name MFA. Even so, turning on MFA for your EHR, email, and remote access tools closes off one of the most common ways attackers get in. Most major EHR systems (Epic, athenahealth, eClinicalWorks, NextGen) already support it.

Free options like Microsoft Authenticator or Google Authenticator make this a low-cost or no-cost upgrade for most practices.

4. Train Staff to Recognize Phishing Emails

Many ransomware attacks start with a single employee clicking a malicious link in a convincing email. One person. One click. That’s all it takes.

Regular phishing awareness training (not a once-a-year slideshow, but quarterly simulated phishing exercises) is one of the highest-leverage investments you can make. The proposed HIPAA Security Rule update would require this training at least once every 12 months. You would also need written proof. That proposal is not final yet.

5. Create a Documented Downtime Procedure

UMMC had downtime procedures to fall back on. Does your practice? If your EHR goes down tomorrow morning, does every staff member know:

• How to record patient care on paper forms?
• How to access medication lists?
• How to contact patients with scheduled appointments?
• Where to find printed copies of key workflows?

Write it down. Print it. Put it somewhere people can actually find it when the network is down. If your practice needs a step-by-step ransomware response plan, build one before you need it.

6. Know Who to Call Before an Attack Happens

Before an incident occurs, build your contact list:

• Your IT vendor or managed security provider: on speed dial
• Your cyber insurance carrier: policy number and claims line
• Your healthcare attorney: HIPAA breach notification has legal deadlines
• FBI’s IC3: ic3.gov for reporting cybercrime
• CISA: 1-888-282-0870 for federal incident assistance

You don’t want to be Googling any of this while your systems are locked.

What to Do If Ransomware Hits Your Practice

If your practice gets hit, the first instinct is often to try to fix it quietly. Don’t.

Under HIPAA, you must tell the people affected by a breach without unreasonable delay. The latest you can do it is 60 days after you discover the breach. If a breach affects more than 500 residents of one state, you must also notify prominent media outlets in that state. Trying to handle it quietly can make the legal situation worse. OCR’s enforcement actions in 2025 show what penalties can look like.

Disconnect affected systems from your network right away. Don’t try to remove the malware yourself. You could destroy forensic evidence (the clues investigators need). Call your IT provider and insurance carrier. Document everything from the moment of discovery.

And do not pay the ransom without legal and law enforcement guidance. Paying doesn’t guarantee data recovery, may violate OFAC sanctions rules, and funds the next attack on someone else in healthcare.

The Bottom Line

The UMMC ransomware attack will eventually become a case study. But you don’t have to wait for the postmortem. The lessons are already clear:

• Healthcare organizations are a top ransomware target
• Even a large, well-resourced system can lose its clinics for more than a week
• Small practices are hit often, and many have no dedicated IT team
• Prevention usually costs far less than recovery

The clinics at UMMC were still closed a week after the attack. Patients who counted on those clinics had their visits put off. That’s what a ransomware attack looks like in human terms.

Your patients are counting on you to not be next.

Related Reading

• Ransomware Hit Your Practice: The First 72 Hours. A step-by-step incident response checklist for when the worst happens.
• What to Do About Healthcare Breaches (2025). What the 2025 breach numbers say about smaller targets.
• 7 Key Changes Proposed for the HIPAA Security Rule. MFA, encryption, and more, as proposed in January 2025 (not final yet).
• MFA and HIPAA: A Plain-English Guide. How to roll out multi-factor authentication without losing your staff.
• How to Conduct a HIPAA Risk Assessment. A step-by-step process for finding your weak spots.

Not sure where your practice stands on ransomware readiness? One Guy Consulting offers affordable HIPAA compliance packages, including risk analysis, security policies, and incident response planning tailored for small healthcare practices.

Sources

• 45 CFR 164.308: Administrative Safeguards
• HHS OCR Resolution Agreements and Civil Money Penalties
• CNN: Major cyberattack forces closure of clinics across Mississippi (Feb. 20, 2026)
• UMMC: ‘This has pulled us together’ (Mar. 2, 2026)

Cybersecurity Threats and Lessons

• Cloudflare Outage 2026: Business Lessons
• Kadnap Botnet: Healthcare Threat Analysis
• Supply Chain Attack: Telnyx Breach Lessons
• Vercel Security Incident Analysis