The scammers’ window: patient communication when a hospital goes dark

The week

On May 20, 2025, Kettering Health, a nonprofit health system with hospitals and outpatient facilities around Dayton, Ohio, reported a system-wide technology outage caused by a cyberattack, later confirmed as ransomware. It canceled elective inpatient and outpatient procedures, its call center was affected, and clinicians moved to downtime procedures on paper. Within days, the health system warned that scammers were calling patients, claiming to be Kettering staff and requesting credit card payments for medical bills. It said it was not making such calls during the outage. In early June, the Interlock ransomware group claimed responsibility and began publishing data it said it had stolen. Kettering restored its Epic electronic health record on June 2, about two weeks after the attack began.

Most writing about hospital ransomware focuses on clinical operations: diversion, paper downtime procedures and the long road back to the electronic health record. The Kettering Health attack exposed something less discussed. The moment a health system goes quiet, someone else starts talking to its patients, and in this case it was criminals asking for card payments. Outage communication has four separate design problems, and each needs a decision before the attack: the channels that survive, the answers patients need, the impersonation that follows, and the authority to speak. Each is owned by a different team, which is why they are so often left undone.

The channels that survive

A modern health system reaches patients through its portal, automated reminders by text and phone, email, a central call center and its website. Many of those depend on the same infrastructure ransomware takes down. The portal is tied to the EHR. Reminder systems pull from scheduling. Call center software may authenticate against the internal directory. When the attack hits, the system loses most of its voice at once.

Planning starts with a channel inventory that records, for each channel, what it depends on: the internal network, the corporate identity system, corporate email, the EHR. Channels that depend on none of those survive. Typical survivors are a website hosted outside the internal network, verified social media accounts, local broadcast media, and a cloud call center platform with its own administrator accounts protected by separate multifactor authentication. A pre-registered mass texting service, with patient contact lists exported on a schedule to an off-network store, closes the largest gap. Each survivor should be tested in an exercise that assumes the internal network and corporate email are both gone.

The answers patients need

Patients in an outage ask predictable questions. Is my surgery still on? Should I go to the emergency department? How do I refill a prescription? Where do I go for dialysis or infusion? Should I pay the bill I received last week? When nobody answers, patients guess, call repeatedly, show up at the wrong site or drop out of care.

Because the questions are predictable, the answers can be drafted in advance. A set of pre-approved messages for the first 72 hours should cover scheduled procedures, emergency care, prescriptions, high-dependency services such as oncology and dialysis, billing, and how the health system will contact patients. Each message needs blanks for dates and sites and a named clinical reviewer. Without them, communications staff write from scratch while clinical leaders run operations, and messages arrive late or contradict each other across sites.

Some answers depend on other organizations. Patients told to fill prescriptions elsewhere need pharmacies that can reach them. Patients redirected for imaging or infusion need receiving sites that expect them. Agreements with neighboring hospitals, retail pharmacies and the regional emergency medical services coordinator should include a shared statement each partner can post. The drafts also need translation into the languages the patient population uses, done in advance rather than during the outage.

The impersonation that follows

Criminals watch the news. A public outage tells them that patients are confused, that normal channels are down and that a call claiming to come from the hospital will be hard to check. A request to settle a balance or update a card on file sounds plausible in ordinary times. During an outage, patients have no way to verify it.

If data was stolen, impersonation gets more convincing, because the caller may know the patient’s name, appointment and physician. The defense is a short list of things the health system will not do during the outage, published on day one. A typical list would say: no calls requesting card payments, no requests for insurance details by text, no links to new payment sites. Pausing outbound billing statements and collections calls for the outage makes that promise true and easy to explain. The list should name one verification route, such as a published callback number on the surviving website. Front-line staff need the same script, so patients who call in hear a consistent answer.

The authority to speak

All of this depends on deciding who speaks for the health system when its normal structures are disrupted. Most hospitals organize emergencies under an incident command structure with a public information officer. Plans often name that officer but not a deputy, an approval path that works without email, or rules that let individual sites post local updates within agreed limits. Communication then stalls while people seek approval through channels that no longer work.

Authority also needs a prior agreement with counsel and the cyber insurer on what can be said before forensic work concludes. Caution about the attack itself is reasonable, and statements about data theft carry legal weight under HIPAA and state breach laws. That caution should not extend to practical patient guidance, which can flow from the first hour. Separating the two message types in advance, with different approvers, removes the most common cause of delay. Exercises should rehearse this split alongside clinical downtime drills, so the people approving messages have practiced doing it without their laptops.

With hindsight

Kettering Health restored Epic on June 2, 2025, and said it had resumed normal operations for key services by mid-June. The Interlock group published data it claimed to have stolen. On July 22, 2025, CISA, the FBI, HHS and the Multi-State Information Sharing and Analysis Center issued a joint advisory on Interlock, describing its tactics and its targeting of healthcare. By 2026 the HHS breach portal listed the incident as affecting about 1.7 million individuals, which made it one of the larger healthcare breaches of 2025.

The early warning about scam calls proved sound and has become a more common feature of hospital outage statements. Impersonation of trusted institutions by phone and text remained a growing fraud pattern across sectors, and criminals continued to use public outages as cover. Health systems that treat patient communication as part of incident response, with surviving channels and ready messages, are better placed in the first days of an outage than those that treat it as public relations.