Cherry Health continues to experience issues, but hasn't publicly acknowledged ransomware attack (Updated)

Threat Overview

Cherry Health is managing technology disruptions affecting their phone systems and operations, according to a notice posted to their website. The health system has confirmed their clinics remain open for scheduled visits during the incident. What makes this notable is the pattern: prolonged IT outages in healthcare often signal cyberattacks, yet organizations frequently delay public disclosure while containing the breach and assessing the damage. The average breach lifecycle is 258 days from initial compromise to containment (IBM Security, 2024), and most of that time is spent in detection and investigation phases. For independent practices watching this unfold, the lesson isn't about Cherry Health specifically — it's about recognizing the warning signs in your own environment and having response protocols ready before an incident occurs.

Attack Vector & Tactics

The article does not specify the attack method or threat actor. However, prolonged technology disruptions affecting multiple systems typically indicate ransomware or similar intrusions that require extensive forensic investigation before public statements can be made. Threat actors targeting healthcare often exploit remote access vulnerabilities, unpatched systems, or credential compromise to gain initial access. Once inside, they move laterally across networks, exfiltrating data before deploying encryption to maximize pressure. Phone system disruption suggests impact to VoIP infrastructure or network segments supporting critical communications — a common tactic to isolate the organization and complicate incident response coordination.

Defense Measures

Healthcare organizations facing similar incidents typically implement several containment steps: network segmentation to isolate affected systems, password resets across all accounts, enhanced monitoring for lateral movement, and activation of business continuity plans including paper-based workflows. The challenge for small practices is maintaining operations during response — you can't shut down patient care while investigating. This is where pre-incident preparation becomes critical: documented response playbooks, tested backup restoration procedures, and clear communication protocols with staff, patients, and regulatory bodies.

What This Means for Your Practice

This incident underscores three operational realities for independent practices:

• Detection delays are costly: The longer an attacker operates undetected in your environment, the more damage they cause. Most practices lack real-time visibility into abnormal access patterns or configuration changes that signal compromise.

• Communication protocols matter: When technology fails, you need pre-established methods to notify staff, contact patients with appointments, and coordinate with vendors and regulators. Waiting until an incident to figure this out multiplies chaos.

• Regulatory clocks start immediately: HIPAA's breach notification rule requires assessment within 60 days of discovery. If ePHI was accessed or exfiltrated, notifications to patients and HHS follow. The investigation itself becomes a compliance exercise under time pressure.

For practices without dedicated IT staff, the gap between "something's wrong" and "we know what happened and how to fix it" can stretch for weeks while forensic teams work. That's weeks of operational disruption, potential lost revenue, and mounting regulatory exposure.