Prospect Medical’s ransomware attack ended up on the table in a hospital sale
The August 2023 attack on Prospect Medical Holdings hit an operator that was already financially stretched and mid-way through selling three Connecticut hospitals. For such operators, cyber resilience is a balance-sheet and deal term, priced by buyers, lenders and state approvers.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On August 3, 2023, Prospect Medical Holdings, which operated hospitals and clinics in California, Connecticut, Pennsylvania and Rhode Island, was hit by a cyberattack that took many of its systems offline. Several hospitals diverted ambulances, postponed elective procedures and fell back to paper. Disruption lasted weeks at some sites, with systems restored in stages. The Rhysida ransomware group later claimed responsibility and said it had stolen data. HHS’s health sector cybersecurity coordination center published an analyst note on Rhysida the following day. At the time, Prospect had a pending agreement, announced in 2022, to sell three Connecticut hospitals to Yale New Haven Health. The hospitals were Waterbury, Manchester Memorial and Rockville General, and the reported price was $435 million, subject to state approval.
Earlier in this series we covered downtime at Universal Health Services and CommonSpirit as clinical and workforce problems. Prospect had those problems too. What made it distinctive was its position. It was a private-equity-backed operator with a history of financial strain, it had a hospital sale under state review, and its Connecticut and Rhode Island hospitals were closely watched by state officials. Within weeks, the attack was part of the negotiation over that sale. For financially stretched operators, a cyberattack is a solvency and transaction event, and cyber resilience is priced by people outside the security function. We look at three of them in turn: the operating cash position, the deal, and the public approvers.
The operating cash position
A hospital that loses its systems keeps most of its costs. Staff still work, often more hours. Supplies are still consumed. What stops is revenue flow. Diverted ambulances take admissions elsewhere. Elective procedures, which carry the best margins, are postponed. Charges captured on paper wait to be entered, and claims cannot be submitted until coding and billing systems return. Cash collections fall weeks after the attack, when the backlog reaches payers.
Recovery adds its own costs: forensic firms, restoration work, overtime, temporary staff for charge entry, and often new hardware. Cyber insurance may cover part of this, subject to limits, retentions and exclusions. For an operator with weak liquidity, the timing matters as much as the total. A few weeks of lost collections can push a system against its lending covenants or delay payments to vendors and landlords. Prospect, like several hospital operators of the period, leased hospital real estate under sale-leaseback arrangements, which made rent a fixed claim on shrinking cash.
The finance team should therefore own part of cyber resilience planning. That means modeling a multi-week outage in the liquidity forecast, knowing which payer advance programs and credit lines are available, and checking cyber insurance terms against realistic recovery costs. A chief financial officer who has run that scenario can answer a lender’s question on day three of an incident. One who has not is negotiating from surprise.
The same team should know which revenue streams depend on which systems. Laboratory, imaging and pharmacy billing often run on separate applications from the main revenue cycle platform. Restoring them in the right order brings cash back sooner. A recovery plan ranked only by clinical priority can leave the most valuable billing systems at the back of the queue, when several could be restored in parallel at modest cost.
The deal
An acquirer of a hospital is buying its future cash flows and its liabilities. An attack during a pending sale changes both. Systems may need replacement. Data theft creates notification costs, regulatory exposure and litigation. Lost revenue weakens the operating results on which the price was set. The buyer also inherits whatever the attacker left behind, which may not be known for months.
In Prospect’s case, Connecticut reporting in October 2023 described Yale New Haven Health seeking about $80 million in state support for the three hospitals’ recovery. It also sought to renegotiate the agreed price. The state declined to fund the request. The sale did not close.
For buyers, the episode argues for cyber diligence that goes beyond questionnaires. Useful steps start with an independent technical assessment of the target’s identity systems, backups and segmentation. A review of incident history and open regulatory matters comes next. The purchase agreement should then carry specific representations about cyber incidents, with indemnities or escrow sized to the risk. Purchase agreements can also include covenants on security investment between signing and closing. That gap often runs many months for hospital deals that need regulatory approval, and an attack can land inside it. For sellers, the inverse holds. A target with documented recovery capability and a clean incident history is easier to sell and harder to reprice.
The public approvers
Hospital transactions in many states need approval from regulators: certificate of need programs, attorneys general reviewing charitable assets and conversions, and sometimes the governor’s office. Communities and their elected officials follow these deals closely, because the hospitals are often the main source of care in a town.
A cyberattack gives these approvers new questions. Can the operator keep the hospitals running safely? Who pays for recovery? Should the state provide money, and on what conditions? Should approval of a sale depend on security commitments? Prospect’s hospitals in Connecticut and Rhode Island were already watched closely by state officials. The incident added a public safety dimension, since diversion and paper operations affect residents directly.
Operators in this position should expect to brief state health departments and approvers early, with a recovery timeline and evidence of patient safety measures. Approvers, for their part, can treat cyber resilience as a condition of approval in the same way they treat capital commitments and charity care. That might mean requiring an independent security assessment before closing, or a commitment to fund specific improvements after it. A state that has invested in reviewing a transaction has an interest in the hospitals surviving the next attack.
The trade-off is real. Conditions add cost to deals that are often meant to rescue struggling hospitals, and a buyer facing too many conditions may walk away. Conditions tied to specific, measurable controls, such as tested offline backups and multi-factor authentication for remote access, are easier to accept than open-ended commitments.
With hindsight
Connecticut approved the sale’s certificate of need in March 2024. Yale New Haven Health continued to dispute the price and later in 2024 sued to exit the agreement, citing the cyberattack among problems that included unpaid taxes and vendor obligations. Prospect filed for Chapter 11 bankruptcy in January 2025, for reasons reaching well beyond the attack, and some of its hospitals were later sold or closed. The Change Healthcare attack in February 2024 showed the revenue-cycle side of the problem at national scale, with providers across the country losing claims processing for weeks. HHS published voluntary cybersecurity performance goals for the sector in January 2024 and proposed tougher HIPAA Security Rule requirements at the end of that year.