On 27 January 2025 Frederick Health Medical Group — around 4,000 staff across more than 25 locations, and one of the largest employers in its county — was hit by ransomware. Attackers reached a shared server, took files, then deployed encryption. Data on more than 934,000 patients was stolen.
Appointments were cancelled, the Frederick Health Village Laboratory closed temporarily, operations were restricted across multiple sites, and the organisation activated what it termed "mini disaster status".
The Phrase Tells You The Plan Already Existed
Hospitals maintain graded emergency postures for mass-casualty events, severe weather and utility failure. "Mini disaster status" is a rung on a ladder somebody built in advance, with defined authorities and defined procedures.
That a cyber incident could be slotted into an existing clinical emergency framework is the useful finding. It is the difference between improvising a response and invoking one — and it is why this desk kept crediting manual continuity at 26-0126 and 25-0824.
A Shared Server Is The Recurring Architecture
The reported entry point was a shared server. Not a specialist clinical system, not a medical device — the ordinary file infrastructure that a distributed provider uses to work across 25 locations.
It is the same shape as the Nevada file at 25-0824: the component that makes a federated organisation function is the component whose compromise reaches all of it.
Theft Before Encryption Is Now Standard Sequencing
Files were taken first, then ransomware deployed. That ordering is deliberate and near-universal now: exfiltration provides leverage that survives a successful restore from backup.
An organisation with excellent backups still faces publication. This desk filed the endpoint of that trend at 26-0304 — encryption falling to a third of healthcare incidents while extortion-only tripled.
Compiled from public reporting, listed below. No attribution has been established. We have not reviewed the affected records. Corrections: corrections@forensicpost.com.