Ransomware Incident Library
Ransomware attacks: a sourced database of what happened, and what it cost
Ransomware has moved from a nuisance to a threat that shuts down hospitals, halts fuel pipelines, and disrupts entire industries. This library documents major, publicly-reported ransomware attacks — the date, the damage, how the attack unfolded, and what it teaches. Every figure is drawn from public reporting and cited.
Why we maintain this library
Ransomware is now one of the defining operational risks of the digital age, and healthcare has become its most consequential target — because in a hospital, downtime is a patient-safety problem, not just an IT one. We built this library to document what actually happens when ransomware hits: the real timelines, the real costs, and the real operational consequences, drawn from official disclosures and reputable reporting.
Each case study follows the same structure — what happened, the impact, how the attack unfolded across the kill chain, the recovery, and the lessons — so you can compare incidents and understand the patterns. Where we cite a figure, we cite a source, and we present numbers as reported or estimated because loss figures often vary between disclosures.
Browse the database
Ransomware attacks by year
Industries covered: Energy, Government, Healthcare, Hospitality, IT & Managed Services.
2024
In June 2024, a ransomware attack on CDK Global — the software backbone for thousands of North American car dealerships — knocked dealer systems offline for around two weeks, forcing dealers back to pen and paper and disrupting the auto-retail sector nationwide.
Read the case study →In June 2024, a ransomware attack on Synnovis — a pathology provider for NHS trusts in south-east London — halted blood testing and transfusions across major hospitals, forcing cancelled operations and becoming one of the UK's most serious healthcare cyber incidents.
Read the case study →In May 2024, a ransomware attack on Ascension — one of the largest U.S. health systems with 140+ hospitals — forced a return to manual processes for weeks and disrupted clinical care across multiple states.
Read the case study →The February 2024 ransomware attack on Change Healthcare disrupted medical claims and payments nationwide, affecting an estimated 100 million people and becoming one of the costliest healthcare cyberattacks on record.
Read the case study →2023
Over the Thanksgiving holiday in November 2023, a ransomware attack on Ardent Health Services forced more than two dozen hospitals across multiple US states to divert emergency patients and take systems offline.
Read the case study →In October 2023, a ransomware attack by the Rhysida group crippled the British Library — one of the world's great libraries — knocking out core services for months in a case notable for the institution's unusually transparent post-incident review.
Read the case study →In September 2023, a ransomware attack on MGM Resorts — enabled by a phone call to the IT help desk — disrupted hotels and casinos across Las Vegas and beyond for around ten days, at a reported cost near US$100 million.
Read the case study →Beginning in May 2023, the Cl0p group exploited a zero-day flaw in the widely-used MOVEit file-transfer software to steal data from thousands of organizations worldwide — one of the largest supply-chain extortion campaigns ever recorded.
Read the case study →2022
In November 2022, a ransomware attack on the All India Institute of Medical Sciences (AIIMS) in Delhi crippled one of India's premier hospitals for around two weeks, forcing a return to manual operations and becoming a landmark healthcare cyber incident in India.
Read the case study →In October 2022, a ransomware attack on CommonSpirit Health — one of the largest U.S. hospital systems — disrupted electronic health records across multiple states and reportedly carried a financial impact near US$150 million.
Read the case study →Turn these lessons into resilience
Immune is built on exactly these attack patterns — detect in seconds, contain before spread, and self-heal from immutable backups. See it protect a hospital like yours.