Ransomware Attack at Springhill Medical Center

Teaching Note for HBS Case No. 123-065. In July, 2019, Springhill Medical Center (“SMC”) in Mobile, Alabama fell prey to a malicious ransomware attack that crippled the hospital’s internal network systems and public-facing web page. While the hospital rushed to securely restore the network, medical personnel scrambled workarounds to continue medical services. Amidst the chaos, a baby was born in the hospital with umbilical cord wrapped around her neck that had resulted in severe brain injury and died nine months later. The mother and family sued SMC, alleging the hospital failed to inform her of the cyber incident, which she believed had compromised the quality of care and led to an otherwise preventable tragedy. The case discusses the important questions of how SMC had responded to the ransomware attack and how hospitals and other organizations should treat the ever-increasing threat of cyber breaches.