Kettering Health was attacked on 20 May 2025, affecting 1.7 million individuals. The health system cancelled appointments and shut down approximately 600 digital applications while restoring systems. Employees switched to pen and paper to record patient information.
Six Hundred Is The Number Worth Sitting With
Most people, asked how many distinct applications a hospital runs, would guess a few dozen. The real figure at a mid-sized health system is in the hundreds, accumulated over decades: scheduling, imaging, pharmacy, laboratory, billing, transcription, bed management, staff rostering, specialty registries, device integrations.
Each was procured for a reason, each has a clinical constituency, and most have no owner who could tell you today what would break if it stopped.
Shutting Them Down Was The Decision, Not The Damage
This desk made the argument at West Pharmaceutical in 26-0507 and TruStage in 26-0715b: disconnecting early is frequently correct containment and always looks worst.
Doing it across 600 applications in a live hospital is that decision at maximum difficulty. It means accepting certain, immediate clinical disruption in exchange for bounding an intrusion you cannot yet scope.
Paper Works Because Somebody Kept It Working
Staff reverting to handwritten records is the fallback this database keeps recording — at Brockton in 26-0407, at New Britain in 26-0126, at the European airports in 25-0919.
In healthcare it carries a specific cost the other sectors do not: every handwritten record must eventually be reconciled into the electronic record, and the reconciliation itself introduces clinical risk. A fortnight of paper is not a fortnight of delay — it is a fortnight of delay plus a data-integrity project.
Compiled from public reporting, listed below. Attribution has not been established by this desk. We have not reviewed clinical outcomes. Corrections: corrections@forensicpost.com.