Breach Report: Tallahassee Memorial suspected ransomware attack affects 20,000+, “cripples” hospital for weeks, diverts ambulances, involves FBI, and suspends certain operations

(Image source: Yelp & Tallahassee Memorial HealthCare, n.d.)

One-sentence summary:

Tallahassee Memorial HealthCare suffered a suspected ransomware attack in January 2023, affecting over 20,000 patients after having its operations significantly disrupted for weeks.

Who was involved?

Tallahassee Memorial HealthCare, 20,000+ patients, FBI, Florida Department of Law Enforcement, and a threat actor.

What was the timeline?

January 26, 2023: Breach starts

February 2, 2023: Breach ends

February 3, 2023: Tallahassee Memorial Healthcare detects the breach.

February 7, 2023: Tallahassee Memorial allegedly is “still using pen and paper” (Andrews, 2023)

February 14, 2023: Tallahassee Memorial HealthCare reports finally transitioning back to electronic medical records

February 15, 2023: Tallahassee Memorial HealthCare reports health IT systems are fully operational and “restored”

March 31, 2023: Tallahassee Memorial Healthcare begins victim breach notification

What occurred?

Tallahassee Memorial HealthCare faced a cyber intrusion on January 26, 2023, lasting less than a week (Tallahassee Memorial HealthCare, 2032d). Although the full details of the attack have not been disclosed by Tallahassee Memorial, credible sources have attributed the attack to a ransomware attack (Schorsch, 2023). Despite the short half-life of the attack, the operational disruption was apparent (HIPAA Journal, 2023; Wadhwani, 2023). Ambulances were diverted and non-essential services were stopped (HIPAA Journal, 2023). The FBI and Florida Department of Law Enforcement were also allegedly involved and assisting with the breach investigation (Burlew, 2023). Hospital employees were reportedly required to take PTO (Murphey & Kaplan, 2023). Medical records were required to be performed via pen and paper for weeks before systems were restored (Andrews, 2023; Tallahassee Memorial HealthCare, 2023a; Tallahassee Memorial HealthCare, 2023b). Finally, Health IT systems were fully restored almost two weeks after the breach was detected (Tallahassee Memorial HealthCare, 2023c). As a result of the breach, over 20,376 patients are potentially affected via certain information, including: “names, addresses, dates of birth, Social Security numbers, health insurance information, medical record numbers, patient account numbers, and/or limited treatment information related to care received at TMH” (HHS, 2023; Tallahassee Memorial HealthCare, 2032d).

Estimated costs:

Associated incident response costs, “independent experts,” M-F call center, breach notification costs, operational disruption costs, potential lost business, victim identity services

Involved laws:

Federal: HIPAA and HITECH

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Andrews, L. (2023, February 7). Major hospital system in Florida STILL using pen and paper after cyberattack. Mail Online. Retrieved April 8, 2023, from https://www.dailymail.co.uk/health/article-11723557/Major-hospital-Florida-using-pen-paper-cyberattack.html#:~:text=Hospital%20system%20in%20Florida%20is,cyber%20hack%20on%20IT%20system&text=Tallahassee%20Memorial%20HealthCare%2C%20which%20serves,had%20been%20hacked%20last%20Thursday.

Burlew, J. (2023, February 6). FBI working with TMH to “assess the situation;” computers still offline after cyber incident. Tallahassee Democrat. Retrieved April 8, 2023, from https://www.tallahassee.com/story/news/local/2023/02/06/fbi-working-with-tallahassee-hospital-computers-remain-offline/69875905007/

HHS. (2023, March 31). U.S. Department of Health & Human Services – Office for Civil Rights. Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information. Retrieved April 8, 2023, from https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

HIPAA Journal. (2023, February 6). Tallahassee Memorial HealthCare Diverts Ambulances Due to Cyberattack. Retrieved April 8, 2023, from https://www.hipaajournal.com/tallahassee-memorial-healthcare-diverts-ambulances-due-to-cyberattack/

Murphey, J., & Kaplan, K. (2023, February 9). TMH employee: remote workers forced to use PTO during cybersecurity incident. https://www.wctv.tv. Retrieved April 8, 2023, from https://www.wctv.tv/2023/02/09/tmh-employee-remote-workers-forced-use-pto-during-cybersecurity-incident/

Schorsch, P. (2023, February 10). Tallahassee Memorial HealthCare making progress after suspected ransomware attack. Florida Politics – Campaigns & Elections. Lobbying & Government. Retrieved April 8, 2023, from https://floridapolitics.com/archives/585686-tallahassee-memorial-hospital-victim-of-suspected-ransomware-attack/

Tallahassee Memorial HealthCare. (2023a, February 9). Update on IT Security Event Thursday, Feb. 9, 2023 Tallahassee, Florida (FL), Tallahassee Memorial HealthCare. Retrieved April 8, 2023, from https://www.tmh.org/news/2023/update-on-it-security-event-thursday-feb-9-2023

Tallahassee Memorial HealthCare. (2023b, February 14). Progress on IT Security Event Tuesday, Feb. 14, 2023 Tallahassee, Florida (FL), Tallahassee Memorial HealthCare. Retrieved April 8, 2023, from https://www.tmh.org/news/2023/progress-on-it-security-event-tuesday-feb-14-2023

Tallahassee Memorial HealthCare. (2023c, February 15). Progress on IT Security Event Wednesday, Feb. 15, 2023 Tallahassee, Florida (FL), Tallahassee Memorial HealthCare. Retrieved April 8, 2023, from https://www.tmh.org/news/2023/progress-on-it-security-event-wednesday-feb-15-2023

Tallahassee Memorial HealthCare. (2023d, March 31). Notice to Patients Regarding IT Security Event Tallahassee, Florida (FL), Tallahassee Memorial HealthCare. Retrieved April 8, 2023, from https://www.tmh.org/news/2023/notice-to-patients-regarding-it-security-event

Wadhwani, S. (2023, February 7). Cyberattack Cripples Florida Hospital’s Emergency Treatment Ability. Spiceworks. Retrieved April 8, 2023, from https://www.spiceworks.com/it-security/security-general/news/tallahassee-memorial-healthcare-cyberattack/

Yelp & Tallahassee Memorial HealthCare. (n.d.). l.jpg. Yelp. https://s3-media0.fl.yelpcdn.com/bphoto/mKrNgYapHvTkN564WZgn7Q/l.jpg

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com