WASHINGTON — A sophisticated ransomware attack has crippled the information systems of a major healthcare provider operating 40 hospitals across 12 states, forcing emergency rooms to divert ambulances and canceling thousands of elective surgeries. The attackers, identified by cybersecurity firm Mandiant as the Russia-linked "BlackMatter" group, have encrypted electronic health records, billing systems, and medical device networks, demanding $50 million in Bitcoin for decryption keys. The FBI, CISA, and HHS are coordinating the federal response.

The attack exploited a zero-day vulnerability in a widely used electronic health records platform, gaining initial access through a phishing email sent to a hospital administrator. From there, the attackers moved laterally through the network over a period of three weeks before triggering the ransomware simultaneously across all 40 facilities — a tactic known as a "timed detonation" designed to maximize disruption.

The incident has reignited calls for federal cybersecurity mandates in the healthcare sector. Senator Mark Warner (D-VA) has introduced legislation requiring all healthcare providers receiving Medicare reimbursement to meet minimum cybersecurity standards, including multi-factor authentication, network segmentation, and 72-hour breach notification. The American Hospital Association estimates that US hospitals have spent $45 billion on cybersecurity since 2020, but the threat continues to escalate.