Prospect Medical’s ransomware attack ended up on the table in a hospital sale

The week

On August 3, 2023, staff at hospitals in four states found that their computers no longer worked. Prospect Medical Holdings, which operated hospitals and clinics in California, Connecticut, Pennsylvania and Rhode Island, had been hit by a cyberattack that took many of its systems offline.

Prospect was a Los Angeles-based operator. Trade press at the time counted its hospitals and regional health systems in those four states, plus roughly 166 outpatient clinics. The company said it had taken systems offline after a “data security incident” and brought in outside cybersecurity specialists to investigate. The FBI was reported to be assisting. A banner on Prospect’s website said that all of its facilities were affected, which is what a shared corporate network tends to produce.

For patients and clinicians, the effects were immediate. Several hospitals diverted ambulances, meaning paramedics were told to take emergency patients to other hospitals instead. They postponed elective procedures, the planned operations and scans that can safely wait a few days or weeks. And they fell back to paper: handwritten orders, printed medication lists and runners carrying results between departments, in buildings designed around electronic records. Disruption lasted weeks at some sites, with systems restored in stages rather than all at once.

The details varied by site. In Connecticut, the Eastern Connecticut Health Network, which runs Manchester Memorial and Rockville General, diverted ambulance arrivals and stroke patients on the first day. A notice the next day listed elective surgery, gastrointestinal procedures, some outpatient imaging, outpatient blood draws and physical therapy as unavailable. By the following Monday, August 7, most of those services were back, with imaging and blood draws still limited.

Waterbury Hospital said the outage affected all of its inpatient and outpatient operations. That Monday it closed its outpatient blood draw sites, diagnostic radiology, women’s imaging, open MRI and cardiopulmonary rehabilitation locations. In Pennsylvania, Crozer Health in Delaware County reported a systemwide outage and initially diverted stroke and trauma patients. In Rhode Island, CharterCARE’s two hospitals also had outages but kept accepting emergency walk-ins and scheduled surgeries. As of August 7, Prospect had not given a date for a return to normal operations.

The Rhysida ransomware group later claimed responsibility and said it had stolen data. Ransomware is malicious software that locks an organization’s files and systems until a ransom is paid; groups like Rhysida increasingly also copy data before locking it, so they can threaten to publish it as extra pressure. HHS’s Health Sector Cybersecurity Coordination Center, a federal team that warns hospitals and health companies about threats, issued an alert on Rhysida the following day.

That alert described a young operation. According to HC3, Rhysida had appeared in mid-May 2023, when its victim support portal went live on the Tor network. It ran as ransomware-as-a-service, renting its tools to affiliates, and used phishing and the Cobalt Strike attack toolkit to get in and move around. Its earlier victims were mostly in education, government, manufacturing and technology. HC3 noted a possible link to an older group, Vice Society, though some outside researchers disputed it. Within days, people close to the Prospect investigation were telling reporters that Rhysida was believed responsible.

When Rhysida posted its claim later in August, it said it held about a terabyte of files plus a larger database. It said the haul included more than 500,000 Social Security numbers, passports and driver’s licenses, patient files, and financial and legal documents. Those were the attacker’s claims, made to pressure a payment. They still set the agenda for what the company, its patients and its counterparties would have to work through.

The timing made this more than an operational crisis. Prospect had a pending agreement, announced in 2022, to sell three Connecticut hospitals to Yale New Haven Health. The hospitals were Waterbury, Manchester Memorial and Rockville General, and the reported price was $435 million, subject to state approval. Deals like this can take many months to clear the state review that hospital sales require. In Connecticut that review runs through the Office of Health Strategy’s certificate of need process.

So the attack landed in the middle of a transaction. It hit a seller whose finances were already under strain and a buyer that now had to ask what it was really buying. It also hit state officials, who had to weigh both the deal and the safety of residents who depended on those hospitals. The ransomware locked computers. Its larger effect was on money, negotiation and public trust.

Prospect had the clinical and workforce problems familiar from other hospital downtime: diverted ambulances, delayed procedures, staff working on paper. What made it distinctive was its position.

Prospect was a private-equity-backed operator with a history of financial strain. It had a hospital sale under state review. And its Connecticut and Rhode Island hospitals were closely watched by state officials. Within weeks, the attack was part of the negotiation over that sale. For financially stretched operators, a cyberattack is a solvency and transaction event, and cyber resilience is priced by people outside the security function. Three groups of them matter most: the people who manage operating cash, the parties to the deal, and the public approvers. All three start from what a hospital actually loses when its systems go dark.

The case is also unusually well documented. Most ransomware attacks fade from view once systems return. This one generated lawsuits, state regulatory statements and, eventually, bankruptcy court filings. Those records show how each group priced the attack, which is rarer and more useful than another account of the outage itself. The sections below take the operational loss first, then the three groups in turn, then what a board should draw from them and what an operator in good shape looks like.

What a hospital loses when its systems go down

A modern hospital runs on a web of connected software. At the center is usually the electronic health record, or EHR: the digital chart that holds each patient’s history, medications, test results and doctors’ notes. Around it sit many other systems. Laboratory software sends blood test results to clinicians. Imaging systems store and display X-rays and scans. Pharmacy systems check doses and drug interactions. Scheduling tools book operating rooms. And a set of finance applications, together called the revenue cycle, records what was done for each patient, translates it into billing codes, and sends claims to insurers and government payers.

When ransomware locks these systems, the hospital does not lose its doctors, nurses or equipment. It loses the ability of those parts to communicate quickly and safely. Clinicians can still treat patients, but more slowly, with more room for error and with far more staff effort per patient. That is why hospitals divert ambulances during attacks: not because they cannot care for anyone, but because they cannot safely handle the most time-critical cases at normal volume.

The connective tissue goes first

The parts that fail are often less visible than the EHR. Hospitals pass messages between systems through an interface engine, software that translates an order in one application into a request in another. A lab order, an admission or a medication change each travels as a message. When the engine is down, every system may still run but none of them can talk. Lab analyzers keep producing results that never reach the chart.

Identity is the other piece of connective tissue. Staff log in to most applications through a central directory, usually Microsoft’s Active Directory. The federal advisory on Rhysida, published that November, described actors who signed in through virtual private networks with stolen credentials, often where multi-factor authentication was missing. It also described tools for copying the directory’s password database and moving between machines. Once an attacker has that level of access, every system that trusts the directory is suspect. Recovery has to start by rebuilding identity, before any clinical application can safely come back.

Shared infrastructure widens the damage. A multi-state operator usually runs one corporate network, one directory and one data center or cloud tenant for all its hospitals. That saves money and makes central security monitoring possible. It also means one intrusion can reach every facility, which is what Prospect’s “all facilities” notice reflected. A standalone community hospital has a smaller blast radius but fewer staff to recover. An academic system has more engineers but more applications to restore. Each structure trades one exposure for another.

Working on paper is harder than it sounds. Most hospitals keep “downtime procedures” for this situation: printed forms, binders of recent medication lists, and instructions for running lab results by hand. But many staff, especially younger clinicians, have never worked without electronic records. Every order has to be written, carried and double-checked. Every result has to be walked to the right floor. Every charge has to be noted so it can be typed in later. The work gets done, but more slowly, and each paper record becomes a task waiting for someone once the systems return.

Many hospitals also keep read-only downtime workstations, machines that hold a recent snapshot of patient summaries and can print them during an outage. They help only if the snapshot is current and the machines themselves were not reached by the attacker. A downtime plan written for a short power or network failure assumes those tools survive. A ransomware plan cannot assume that.

Restoration is a sequence, and so is the backlog

Recovery is rarely a matter of flipping a switch. Each system has to be checked to make sure the attacker is gone, restored from backups (copies of data kept separately for exactly this purpose), tested and reconnected. That is why Prospect restored systems in stages, and why disruption lasted weeks at some sites. Every day in that state has a cost, and much of that cost falls on the finance team.

A typical order runs from identity and the core network, to the EHR, to the interfaces, to the ancillary systems and finally to billing. Each step needs clinical testing before use. Then comes reconciliation: every paper order, medication administration and charge from the downtime has to be entered into the restored record. Clinical informatics staff, coders and nurses do this work while also running a hospital at normal volume again. For a multi-week outage, the backlog can take as long to clear as the outage lasted.

The operating cash position

A hospital that loses its systems keeps most of its costs. Staff still work, often more hours. Supplies are still consumed. What stops is revenue flow. Diverted ambulances take admissions elsewhere. Elective procedures, which carry the best margins, are postponed. Charges captured on paper wait to be entered, and claims cannot be submitted until coding and billing systems return. Cash collections fall weeks after the attack, when the backlog reaches payers.

That delay is the cruel part. A household that loses a paycheck feels it at the end of the month. A hospital that loses its billing systems feels it later, when the claims that should have been paid do not arrive, just as the recovery bills come due.

How the lag builds

A hospital claim passes through several stages before it becomes cash. A charge is captured, a coder assigns diagnosis and procedure codes, claim-editing software checks it, and a clearinghouse forwards it to the payer. The payer adjudicates it and sends payment with a remittance file. Each stage depends on a system. In normal times the whole chain takes weeks, so a hospital already carries a large balance of work that has not yet turned into cash.

Finance teams track that balance with a few standard measures. Discharged-not-final-billed counts patients who have left but whose claims have not gone out. Days in accounts receivable measures how long billed claims take to collect. Days cash on hand measures how long the organization could pay its expenses from reserves. During an outage the first figure climbs every day. The second follows a few weeks later. The third falls last, and it is the one lenders watch.

Recovery adds its own costs: forensic firms (specialists who investigate how the attacker got in and what they took), restoration work, overtime, temporary staff for charge entry, and often new hardware. Cyber insurance may cover part of this, subject to limits, retentions and exclusions. A retention is the amount the insured pays before the policy responds, much as a deductible is. Exclusions are the situations the policy does not cover at all. For an operator with weak liquidity, the timing matters as much as the total. A few weeks of lost collections can push a system against its lending covenants, the financial conditions a borrower promises its lenders it will meet, or delay payments to vendors and landlords.

Business interruption cover in a cyber policy has its own mechanics. It usually starts only after a waiting period, and the insured must document the lost income, often with forensic accountants. Insurers pay after they have reviewed that proof. A claim for a multi-week outage can take many months to settle. Insurance therefore repairs the income statement eventually, while doing little for cash in the weeks that matter.

Prospect, like several hospital operators of the period, leased hospital real estate under sale-leaseback arrangements. In a sale-leaseback, an operator sells its buildings to an investor and then rents them back. It raises cash up front, but turns ownership into a permanent rent bill. That made rent a fixed claim on shrinking cash. Prospect’s landlord, Medical Properties Trust, would later sit at the mediation table alongside the buyer when the dispute was finally settled.

Different balance sheets, different obligations

How the cash problem surfaces depends on who owns the hospital. A nonprofit system that has issued tax-exempt bonds answers to bondholders and rating agencies. Its bond documents usually set a days-cash-on-hand or debt service coverage test, and many such issuers post notices of material events on the municipal market’s disclosure system. A publicly traded hospital company faced a new rule that very summer. The SEC adopted its cybersecurity disclosure rule on July 26, 2023, requiring a Form 8-K within four business days of determining that an incident is material.

A privately held, investor-backed operator like Prospect fell under neither regime. Its obligations ran to private lenders, landlords and investors under contracts the public does not see. That makes the cash position less visible from outside, until it shows up as unpaid vendors, unpaid taxes or a stalled deal. Yale would later allege that Prospect had not paid vendors for years and owed Connecticut at least $67 million in taxes. Those allegations concern problems that predated the attack. They show how thin the cushion was when the attack arrived.

What the finance team should own

The finance team should therefore own part of cyber resilience planning. That means modeling a multi-week outage in the liquidity forecast, knowing which payer advance programs and credit lines are available, and checking cyber insurance terms against realistic recovery costs. A chief financial officer who has run that scenario can answer a lender’s question on day three of an incident. One who has not is negotiating from surprise.

The same team should know which revenue streams depend on which systems. Laboratory, imaging and pharmacy billing often run on separate applications from the main revenue cycle platform. Restoring them in the right order brings cash back sooner. A recovery plan ranked only by clinical priority can leave the most valuable billing systems at the back of the queue, when several could be restored in parallel at modest cost.

Suppose a three-hospital system has modest cash reserves. After an attack, its IT team restores systems in strict clinical order: EHR first, then lab, then imaging, then billing. Clinically, that is sensible. Financially, it means four weeks without claims going out. Had the finance and IT leaders planned together, they might have restored the imaging billing application in parallel. That would have cost a few days of contractor time and brought back a meaningful slice of revenue weeks earlier. Neither team was wrong. They simply had not planned together.

Payer relationships are part of the plan. Large payers have, at times, advanced cash to providers whose billing was disrupted. Medicare’s accelerated and advance payment program, used heavily in the spring of 2020, is the best-known federal example. Such advances must be repaid by offsetting future claims, so they shift the problem in time rather than removing it. They are still worth knowing about before an incident, along with who at each major payer can approve one.

Other preparations are cheap in advance and expensive in a crisis. Payroll should have a fallback, such as a copy of the last pay run that a processor can repeat if the payroll system is down. Payers’ timely filing limits should be known, since a long outage followed by a slow backlog can push claims toward those deadlines. Medicare, for example, generally allows twelve months from the date of service. A list of the hundred largest vendors, with contacts held outside the network, lets the treasury team decide who gets paid first.

The deal

An acquirer of a hospital is buying its future cash flows and its liabilities. An attack during a pending sale changes both. Systems may need replacement. Data theft creates notification costs, regulatory exposure and litigation. Lost revenue weakens the operating results on which the price was set. The buyer also inherits whatever the attacker left behind, which may not be known for months. Attackers sometimes leave hidden ways back in, so a buyer may be acquiring a network that is still compromised.

In Prospect’s case, Yale New Haven Health officials said repairing the damage to the three hospitals’ computer systems could cost as much as $80 million, and Yale sought to renegotiate the agreed price. The sale did not close.

A buyer’s repair estimate of that kind usually bundles several things. Some of it is remediation: rebuilding the directory, replacing compromised servers and endpoints, and paying for monitoring until the network can be trusted. Some is acceleration: moving the acquired hospitals onto the buyer’s own EHR and network sooner than planned, because the old environment is no longer worth keeping. The seller tends to see the second part as an upgrade the buyer always intended. The buyer sees it as a cost the attack forced. That disagreement is a pricing argument, and it is hard to settle without terms agreed in advance.

Where a purchase agreement bends

Hospital purchase agreements are usually signed long before they close, because regulators must approve them first. The contract governs that gap through a few devices. Ordinary-course covenants require the seller to keep running the business as before. Representations made at signing must usually be true again at closing, a step lawyers call the bring-down. And most agreements let the buyer walk away if a “material adverse effect” occurs, a term defined narrowly and litigated often.

A ransomware attack tests each of these. Was keeping weak security “ordinary course”, or a breach of the covenant? Did a representation about adequate security programs remain true? Is a multi-week outage a material adverse effect, or the kind of industry risk such clauses usually exclude? Without cyber-specific language, both sides can argue in good faith. The Prospect litigation showed exactly that. Yale’s May 2024 suit argued that the breach showed Prospect had not maintained adequate cybersecurity and privacy programs, and that Prospect could not give enough information to confirm its security going forward. Prospect’s June 2024 countersuit argued that Yale had breached the contract by demanding a lower price.

There is precedent outside health care. When Yahoo disclosed huge data breaches during its sale to Verizon, the price was cut by $350 million from an original offer of about $4.48 billion. That deal was renegotiated and closed. The Yale and Prospect deal ended up in court instead.

Diligence that tests rather than asks

For buyers, the episode argues for cyber diligence that goes beyond questionnaires. Due diligence is the investigation a buyer does before committing, and in cybersecurity it too often means a form the seller fills in about itself. Useful steps start with an independent technical assessment of the target’s identity systems: how staff log in and what they can reach. The same assessment should cover backups and segmentation, meaning whether the network is divided into compartments so an intruder in one area cannot easily reach the rest. A review of incident history and open regulatory matters comes next.

Deeper diligence looks for evidence of an intruder already present. That can include a compromise assessment, in which a specialist firm searches logs and endpoints for signs of past access. It can include checking whether remote access uses multi-factor authentication everywhere, which the later Rhysida advisory identified as a common gap. Each of these costs money and needs the seller’s cooperation, and sellers in a competitive process may resist. The buyer’s power to insist is greatest before signing.

The purchase agreement should then carry specific representations about cyber incidents, with indemnities or escrow sized to the risk. A representation is a formal statement of fact by the seller, such as “we have had no undisclosed breaches.” An indemnity is a promise to pay if that turns out to be false. Escrow is money held back from the price, in a separate account, to cover such claims. Purchase agreements can also include covenants on security investment between signing and closing. That gap often runs many months for hospital deals that need regulatory approval, and an attack can land inside it, as it did here.

Two more tools matter. Representations and warranties insurance, common in private deals, usually excludes problems the buyer already knows about, so a breach found in diligence tends to stay with the parties. And many hospital deals include a transition services agreement, under which the seller keeps running IT for the buyer until systems migrate. A buyer that depends on the seller’s network after closing is still exposed to the seller’s security.

Suppose a regional health system is acquiring two community hospitals for a price based on last year’s earnings. Before signing, it pays an independent firm to test the targets’ backups and remote access, and finds that backups are stored on the same network as everything else. The buyer negotiates three protections: a seller commitment to move backups offline before closing, a representation that there have been no undisclosed incidents, and an escrow holding back part of the price for eighteen months. If an attack lands between signing and closing, the contract already says who pays for what. Without those terms, the two sides would be negotiating from scratch, under pressure, with lawyers on both sides and a state regulator watching.

The seller’s side, and the buyer’s type

For sellers, the inverse holds. A target with documented recovery capability and a clean incident history is easier to sell and harder to reprice. Security spending that looks like overhead in a normal year can show up as price protection in a sale year.

The buyer’s type shapes the response. A nonprofit academic system like Yale answers to its board, its bondholders and the state, and has its own reputation to protect. A for-profit chain may move faster on price and terms. A private equity buyer often plans to integrate quickly and resell, so inherited liabilities weigh on its exit value. In each case, the buyer is pricing a risk that the seller’s security team understood better than anyone at the table.

The public approvers

Hospital transactions in many states need approval from regulators: certificate of need programs (which decide whether a community needs a given facility or service), attorneys general reviewing charitable assets and conversions, and sometimes the governor’s office. Communities and their elected officials follow these deals closely, because the hospitals are often the main source of care in a town.

A cyberattack gives these approvers new questions: whether the operator can keep the hospitals running safely, who pays for recovery, whether the state should provide money and on what conditions, and whether approval of a sale should depend on security commitments. Prospect’s hospitals in Connecticut and Rhode Island were already watched closely by state officials. The incident added a public safety dimension, since diversion and paper operations affect residents directly.

Two different state functions

Connecticut’s response showed two separate state roles. The Department of Public Health enforces hospital quality and safety rules, largely the Medicare and Medicaid conditions of participation. During the cyberattack it made extra monitoring visits to the Prospect hospitals, identified violations and required plans of correction. That is a clinical safety function, and it applies whether or not a sale is pending.

The Office of Health Strategy runs the certificate of need review. It offered approval of the Yale deal, with an agreed settlement, on October 20, 2023, roughly eleven weeks after the attack. The settlement required the parties to bring back new terms if the purchase agreement was renegotiated. When Yale sued in May 2024, the office said the lawsuit did not affect the validity of the certificate. An approval does not, by itself, make a deal close.

Operators in this position should expect to brief state health departments and approvers early, with a recovery timeline and evidence of patient safety measures. Approvers, for their part, can treat cyber resilience as a condition of approval in the same way they treat capital commitments and charity care. That might mean requiring an independent security assessment before closing, or a commitment to fund specific improvements after it. A state that has invested in reviewing a transaction has an interest in the hospitals surviving the next attack.

Why approvers hesitate, and why they should act anyway

Approvers have reasons to stay out of cybersecurity. Most certificate of need staff are health planners and economists, not security engineers. Federal law already covers the confidentiality of patient data through HIPAA, enforced by the HHS Office for Civil Rights. A state condition could look like duplication, or like a regulator reaching beyond its expertise.

The answer is that HIPAA governs the protection of data, while approvers care about the continuity of care. Those overlap without being the same thing. A hospital can comply on paper with HIPAA’s risk analysis requirements and still lack the tested backups that would let it reopen in days rather than weeks. Approvers do not need to write security standards. They can ask for an independent assessment and a funded plan, and let specialists judge the detail.

The trade-off is real. Conditions add cost to deals that are often meant to rescue struggling hospitals, and a buyer facing too many conditions may walk away. Conditions tied to specific, measurable controls are easier to accept than open-ended commitments. One example is tested offline backups, copies of data kept disconnected from the network so ransomware cannot reach them. Another is multi-factor authentication for remote access, which requires a second proof of identity, such as a code on a phone, on top of a password.

Other states have their own machinery. Rhode Island reviews hospital conversions under its own statute, with roles for the health department and the attorney general. Pennsylvania has no certificate of need program for hospitals, so its attorney general’s oversight of charitable assets carries more of the weight. A multi-state operator therefore faces several different sets of approvers, each with different powers, after a single attack.

Four lenses for the board

Ransomware is an operational risk, but Prospect’s experience suggests a board should see it through at least four other lenses as well.

Solvency. For a well-capitalized system, a month of disrupted billing is painful but survivable. For an operator already stretched, the same month can decide whether it meets payroll, rent and debt payments. The weaker the balance sheet, the more a cyberattack behaves like a financial shock rather than a technical one. A board can test this with one number: how many weeks of zero collections the organization could absorb before breaching a covenant or missing payroll.

Strategy. Many hospital operators are buying, selling or merging. Any of those plans can be repriced or derailed by an attack at the wrong moment. A board that approves a sale process without asking about cyber exposure during the months before closing has left a large risk unpriced. The same applies in reverse to an acquisition. Its own security team should have reviewed the target before the board votes.

Community and reputation. Hospitals are not ordinary businesses in the eyes of the public. When ambulances are diverted, local officials, journalists and residents notice at once. Goodwill with the community and with state government is an asset an operator will need when it next seeks approval for anything.

Regulation and litigation. Stolen patient data brings notification duties under health privacy law and the likelihood of lawsuits. HIPAA’s breach notification rule requires notice to affected individuals without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more people must also be reported to HHS, and to the media where enough residents of one state are affected. Class actions typically follow. Those costs arrive months or years later, which is exactly why a buyer worries about inheriting them.

Seen together, these lenses explain why the chief financial officer, general counsel and head of strategy each have as much reason as the chief information security officer to ask how resilient the organization really is.

The strongest objection

A fair objection is that Prospect’s fate was set by its finances, not its security. The operator was already under strain, and the later allegations about unpaid taxes and vendors point to problems no backup strategy would fix. On this reading, the attack was incidental, and a board should spend its attention on capital structure.

The objection is right about causation and wrong about relevance. Nobody can show the attack caused the deal to fail or the company to fail. What the record does show is that the attack became the buyer’s stated reason to reprice and then exit. It handed a counterparty a concrete, documented grievance at the moment the seller most needed the deal. Fragile operators are exactly the ones for whom that lever matters most.

An operator in good shape

An operator in good shape treats a cyberattack as a whole-business scenario, not an IT one. Its board has seen a liquidity model of a multi-week outage. Its CFO and chief information officer have agreed a restoration order that balances patient safety with cash. Its insurance has been checked against a realistic recovery bill. Its backups have been tested by actually restoring from them. And if it is selling, it can hand a buyer evidence rather than reassurances.

The evidence is specific. It includes dated restore tests showing how long the EHR and directory took to rebuild. It includes a tabletop exercise in which the CFO, general counsel and communications lead played their parts, with the actions that followed. It includes proof that every remote access path requires multi-factor authentication, and an inventory of the applications each revenue stream depends on. An auditor, a lender or a buyer can check each of these. A policy document alone proves much less.

Operators that get it wrong tend to repeat the same errors:

• Leaving cyber risk to the security team alone. The biggest consequences in Prospect’s story were financial and transactional.
• Assuming insurance will cover it. Limits, retentions and exclusions can leave a large gap, and payouts arrive after the cash is needed.
• Diligence by questionnaire. A buyer that relies on the seller’s own answers is pricing a risk it has not examined.
• Ignoring the signing-to-closing gap. Months can pass between agreeing a deal and completing it. The contract should say what happens if an attack lands in between.
• Telling regulators late. Approvers who learn about an attack from the news are less inclined to be flexible.
• Restoring without the finance team. A restoration order set only by IT can leave revenue systems dark for longer than safety requires.

Ownership matters too. Somebody has to hold each of these items between incidents. In a well-run operator, the CFO owns the liquidity scenario, the general counsel owns deal terms and regulator briefings, and the CIO owns restoration testing. The board’s audit or risk committee reviews all three together at least once a year.

Pricing the risk before someone else does

These questions are meant for a leadership meeting where the CFO, general counsel and CIO are all in the room. Each needs an answer backed by a document or a test result, not an estimate offered on the spot.

• If our main systems were down for four weeks, what would our cash position look like at week six, and would we breach any loan covenants?
• Which revenue streams depend on which systems, and does our recovery plan bring the most valuable ones back early where that is safe?
• What would our cyber insurance actually pay on a realistic recovery bill, after retentions and exclusions, and how fast?
• For any acquisition we are considering, who independently tested the target’s security, and what protection does the contract give us if an attack happens before closing?
• Who would brief state regulators and approvers in the first days of an attack, and what would they say?

An organization that cannot answer the first question will learn the answer from its lenders. One that cannot answer the fourth may learn it from a court. Either way, the price gets set by someone else.

With hindsight

The years after the attack showed how far its consequences reached beyond the server room. Connecticut’s Office of Health Strategy had agreed settlement terms approving the sale in October 2023, just two months after the attack. The deal still did not close. In May 2024 Yale New Haven Health sued to terminate the agreement, pointing to the attack as evidence that Prospect had not maintained adequate cybersecurity. Prospect countersued in June, arguing that Yale had broken the contract by pressing for a lower price.

The data side ran its own course. Later reporting put the number of people affected by the breach at about 1.3 million. A proposed class action in federal court in Pennsylvania survived much of a motion to dismiss in August 2024. The judge found that plaintiffs had standing and had plausibly alleged some of their claims. Litigation of this kind is the slow, expensive tail any buyer worries about inheriting.

The attacker’s methods became clearer too. In November 2023 the FBI, CISA and the Multi-State Information Sharing and Analysis Center published a joint advisory on Rhysida. It described actors who often entered through virtual private networks using valid stolen credentials where multi-factor authentication was not enabled. The group went on to attack other public institutions, including the British Library that autumn, and stayed active in health care into 2024.

Prospect filed for bankruptcy in January 2025, for reasons reaching well beyond the attack. It would be wrong to say the ransomware caused the bankruptcy. It is fair to say the attack arrived at a fragile moment and became part of a contest over who would bear the costs of a struggling hospital system. In February 2025 Yale said it was pulling out of the deal entirely, citing the bankruptcy as proof of disinvestment and mismanagement.

The bankruptcy turned a negotiation into a court-supervised process. Mediation that September brought together Prospect, Yale and Prospect’s landlord, Medical Properties Trust. In September 2025 Yale agreed to pay Prospect $45 million to end the dispute without acquiring any of the hospitals. The two lawsuits were to be dismissed.

Connecticut changed its own machinery in response. Public Act 25-2, signed in March 2025, created an emergency certificate of need process aimed at the Prospect bankruptcy. That December, the Office of Health Strategy used it to approve a Hartford HealthCare subsidiary’s acquisition of Manchester Memorial, including the Rockville campus. Hartford HealthCare had been the first bidder in the court auction, at a reported $86.1 million for the two hospitals. UConn Health filed its own emergency application for Waterbury Hospital in early December 2025.

The Hartford approval carried conditions on services, emergency department hours, behavioral health beds and price growth. Its public summary did not mention cybersecurity, IT or the record system. Even after a sale derailed partly over a cyberattack, the state’s visible conditions focused on access and cost. Approvers had not yet made resilience a standard term.

Elsewhere the outcome was harsher. In Pennsylvania, Crozer Health’s hospitals in Delaware County closed in the spring of 2025 during the bankruptcy, leaving the surrounding communities to rely on other systems. That closure had many causes, and the attack was at most one strain among them.

The wider sector soon learned the same lesson at larger scale. The Change Healthcare attack in February 2024 showed the revenue-cycle side of the problem nationally, with providers across the country losing claims processing for weeks. CMS responded with accelerated payments for affected providers, and Change’s parent company offered temporary funding. The finance team’s view of cyber risk, as a question of when the cash arrives, stopped looking like a niche concern. The attack on Ascension that May, with diversion and paper operations across many of its hospitals, made the clinical side just as plain.

Regulators moved too. HHS published voluntary cybersecurity performance goals for the sector in January 2024. At the end of that year it proposed tougher HIPAA Security Rule requirements, signaling that baseline protections in health care were expected to rise. The proposal included mandatory multi-factor authentication and a requirement to be able to restore critical systems within a set time, both directly relevant to what happened at Prospect.

Cyber resilience, it turned out, shows up in places security teams rarely sit: liquidity forecasts, purchase agreements, state approval conditions and courtrooms. Buyers, lenders and regulators will price it whether or not the organization has. Better that the organization prices it first, with its own numbers, before someone across the negotiating table does it for them.