Ransomware (extortion): Hospital and care home, USA 2021
According to an executive, a ransomware attack in 2021 paralysed the rural hospital’s systems for at least 14 weeks.
- Incident · 2021 · Illinois (Spring Valley), USA
- Evidence: confirmed by an authority
- Ransomware (extortion)
As of
What happened
For months, it was unable to bill insurers, Medicare or Medicaid for services. Together with the pandemic and staff shortages, this led to the hospital closing in June 2023; experts consider it the first hospital to cite a cyber attack as a reason for closure.
- Affected
- St. Margaret's Health (Spring Valley hospital)
- Industry
- Hospital and care home
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
If billing fails, liquidity collapses; an emergency plan for invoicing is as important as one for treatment.
Sources
- Illinois hospital links closure to ransomware attack (opens in a new window) NBC News · 2023-06
- Rural Illinois hospital says 2021 ransomware attack partially to blame for closure (opens in a new window) Fierce Healthcare · 2023-06