ASEC Blog publishes Ransom & Dark Web Issues Week 3, April 2026           Emergence of New Ransomware Groups: TiMC, BlackWater, and Lamashtu [1], [2], [3] NoName05716 Claims DDoS Attacks on South Korean Public & Private Sectors [1], [2], [3] VECT & TeamPCP Campaign: Supply Chain Attack Exploiting Global Travel Platform

Massachusetts’ Signature Healthcare diverts ambulances and cancels services after a cyberattack disrupts hospital operations and pharmacy access.

The hospital Signature Healthcare in Brockton, Massachusetts, diverted ambulances and canceled some services after a cyberattack disrupted operations. Pharmacies couldn’t fill prescriptions, though urgent care and walk-in services remained open.

Signature Healthcare Brockton Hospital is a non-profit community teaching hospital in Brockton, Massachusetts, founded in 1896. It has about 216 beds and serves over 20 surrounding communities, offering services such as medical, surgical, pediatric, and obstetric care, along with advanced diagnostics. The hospital is affiliated with Beth Israel Deaconess Medical Center and plays a key role in the regional healthcare system.

The hospital, part of a network with 15 locations and 150+ physicians, reported the cybersecurity incident on Monday.

“Signature Healthcare and Signature Healthcare Brockton Hospital are currently responding to a cybersecurity incident that has affected certain information systems within our health system.” reads a statement from the healthcare organization. “Upon identifying suspicious activity within a portion of our network, we immediately activated our incident response protocols. We moved to down-time procedures to ensure high-quality patient care and safety. We are working with outside resources to help us investigate the incident and restore operations as quickly as possible.”

The organization has not confirmed a ransomware attack, and the attackers’ motivation are still unknown. At this time, no ransomware group has claimed responsibility for the attack.

It is unclear if threat actors have stolen sensitive data.

Healthcare organizations are prime cybercrime targets due to valuable data, operational urgency, and complex systems. Medical records contain sensitive personal and financial information, making them highly profitable. Hospitals cannot afford downtime, increasing the likelihood of ransom payments. Their large, interconnected networks, legacy devices, and many users expand the attack surface. Combined with often limited cybersecurity maturity, these factors make healthcare an attractive and vulnerable target.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Signature Healthcare)

The Payload Ransomware group claims to have breached the Royal Bahrain Hospital (RBH), a leading healthcare facility in Bahrain.

The Payload Ransomware group claims to have hacked the Royal Bahrain Hospital (RBH) and stolen 110 GB of data. The ransomware gang added the healthcare facility to its Tor data leak site and published the images of allegedly hacked systems as proof of the attack.

The group is threatening to release the stolen data if the ransom is not paid by March 23.

Royal Bahrain Hospital has allegedly been breached by new Payload Ransomware https://t.co/zXlERHcPpe pic.twitter.com/FIRMTc1Bsm

— Dominic Alvieri (@AlvieriD) March 15, 2026

Royal Bahrain Hospital, founded in 2011, is a healthcare facility with 70 beds offering inpatient and outpatient services, including surgery, maternity care, and diagnostics. It serves patients from Bahrain and neighboring countries such as Oman, Qatar, Saudi Arabia, and the United Arab Emirates.

Payload ransomware is a relatively new cybercrime operation using a double-extortion model that combines data theft and file encryption to pressure victims. The group has targeted mid- to large-size companies in sectors such as real estate and logistics, mainly in emerging markets. Technically, the ransomware uses ChaCha20 for file encryption and Curve25519 for key exchange, while deleting shadow copies and disabling security tools.

Like many modern crews, Payload likely operates as a ransomware-as-a-service scheme and runs a Tor leak site to publish data from non-paying victims.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Royal Bahrain Hospital data breach)

The Independent Public Regional Hospital in the western Polish city of Szczecin has been compelled to switch back to a paper-based workflow after suffering a cyberattack over the weekend. Hospital authorities confirmed that the incident, which struck the facility’s IT system on the night of March 7-8, 2026, has temporarily disrupted digital operations, though patients’ health remains uncompromised. Hospital spokesman Tomasz Owsik-Kozłowski explained on Sunday that the cyberattack encrypted parts of the hospital’s data, blocking staff access to critical digital records. “The hospital's priority is to restore access to the IT system and return to standard operating mode,” Owsik-Kozłowski said. Despite the disruption, he stresses that patient care has continued uninterrupted, with all urgent treatments and admissions still being handled, albeit with slower administrative procedures.

The Independent Public Regional Hospital Cyberattack 

In an official statement, the Independent Public Regional Hospital in Szczecin reassured the public:  “Patients’ health and lives are not at risk. Emergency procedures have been activated, including switching to a paper-based workflow. Hospital management remains in constant contact with the appropriate authorities, focusing on restoring IT system access as quickly as possible.”  While the hospital continues to accept new patients, officials are urging those with non-urgent medical needs to consider alternative facilities to reduce delays caused by manual processing. 

Cyberattacks on Medical Facilities 

The Szczecin incident reflects a broader trend of cyberattacks targeting healthcare institutions worldwide. For instance, last month, the University of Mississippi Medical Center (UMMC) in Jackson faced a major attack that forced the shutdown of essential IT systems, including electronic medical records. The disruption led to statewide clinic closures and the cancellation of outpatient surgeries, imaging appointments, and other procedures. Federal agencies, including the FBI, the U.S. Department of Homeland Security, and the Cybersecurity and Infrastructure Security Agency, have been involved in the investigation to assess potential data exposure.  Earlier, in January, Lakelands Public Health experienced a cyber intrusion affecting internal systems. Officials confirmed that sensitive public health records, including infectious disease and immunization data, remained secure. Thomas Piggott, the organization’s Medical Officer of Health and CEO, highlighted the continued emphasis on protecting data while maintaining critical services.  Another notable example occurred at the University of Hawaiʻi Cancer Center, where a ransomware attack identified in August last year and discovered in December, compromised historical research data, including sensitive identifiers for nearly 87,500 participants in a multi-decade epidemiological study. While clinical operations were unaffected, the university undertook extensive recovery and cybersecurity measures, offering affected individuals identity protection services and ongoing monitoring.  Similarly, the Manage My Health platform in New Zealand disclosed a breach affecting over 120,000 users. While core GP clinical systems remained intact, the company warned potential phishing attempts targeting users whose health records were exposed. 

Response and Recovery at Szczecin Hospital 

The Independent Public Regional Hospital in Szczecin has activated emergency protocols similar to those employed in other global incidents. Staff are manually processing patient records and medical procedures while cybersecurity experts work to restore the IT infrastructure.   Hospital authorities continue to coordinate closely with national cybercrime agencies to assess the scope of the breach and prevent further disruptions. Tomasz Owsik-Kozłowski reiterated that despite the setback, patient safety remains uncompromised. “We are committed to returning to our standard digital operations as swiftly as possible,” he said.