Cyberattack Disrupted Patient Care at a Massachusetts Health System

A cybersecurity incident at Signature Healthcare in Massachusetts disrupted hospital and clinic operations beginning April 6, 2026. After detecting suspicious activity within its network, the organization activated incident response protocols and moved to downtime procedures while continuing to deliver patient care with limited system functionality.

Updates over the following days show how the incident affected multiple parts of the organization. Emergency care and surgeries continued, while other services slowed or were temporarily paused.

This created an uneven operating environment, with staff adapting workflows in real time as systems were investigated and gradually restored.

The exact nature of the cyberattack has not been confirmed, and no group has claimed responsibility, leaving open questions as recovery efforts continue.

Why It Matters: Cyber incidents in healthcare extend into patient care, logistics, and daily hospital functions. This case shows how disruptions can unfold over time, requiring continuous adjustment across clinical and operational areas. It also highlights how even short-term system outages can create cascading effects that take days to fully stabilize.

• Incident Response and Downtime Operations: Signature Healthcare identified suspicious network activity and moved quickly to activate incident response protocols. Downtime procedures were put in place across the organization, requiring staff to rely on alternate documentation methods and manual workflows. External cybersecurity specialists were engaged to investigate the issue and support recovery efforts. These actions allowed care delivery to continue, though with slower coordination and reduced access to digital systems.

• Emergency Care Access and Ambulance Diversion: Inpatient care and walk-in emergency services remained available throughout the disruption. At the same time, ambulance traffic was diverted away from Brockton Hospital across multiple days. This indicates constraints in intake capacity or coordination systems, even while on-site care continued.

• Clinical Services Continuity and Treatment Adjustments: Surgeries and procedures continued as scheduled during the incident. Lab work and diagnostic testing remained available, though delays were expected. Chemotherapy infusion services were canceled on April 7, affecting cancer patients who needed to reschedule treatments. In subsequent updates, these services resumed for new patients and were gradually restored for existing patients based on safety considerations.

• Pharmacy Access and Medication Challenges: Retail pharmacies operated by Signature Healthcare were closed at the start of the incident. They later reopened for consultations but remained unable to fill prescriptions. This created a gap for patients needing medications, even as other parts of the system continued functioning. A dedicated phone line was provided to help patients address medication-related questions, offering guidance without fully restoring pharmacy services.

• Administrative Disruptions and Facility Operations: The incident affected administrative capabilities, including delays in lab processing and the inability to fulfill medical records requests. Patient services continued, such as inpatient meals, though with limited flexibility for special requests. Visitor services were also affected, with the cafeteria operating on a cash-only basis due to system limitations.

Go Deeper -> Alert Announcements – Signature Healthcare

Massachusetts Hospital Diverts Ambulances as Cyberattack Causes Disruption – SecurityWeek