UMC Lubbock Ransomware: A Texas Hospital Outage Case Study (Sept 2024)

The September 2024 ransomware attack at UMC Health System in Lubbock is still the right reference point for West Texas clinics, vendors, and local governments — even though the headline outage is more than two years old. As of November 1, 2026, we found no filed class-action settlement, no HHS OCR civil-money penalty, and no public attribution of the UMC incident to a named ransomware brand. What is new since patient letters went out: a February 19, 2025 notice that a ClassAction.org attorney investigation ended without filing suit, and an archived HHS OCR breach entry describing safeguards added after 1,461,776 individuals were affected.

UMC is the region’s Level 1 trauma center — when its network went dark, Covenant and other partners absorbed diverted ambulances. Small practices that share referrals, billing, and Microsoft 365 tenants with hospital partners should treat this as a supply-chain downtime story, not only a “big hospital” story.

Snapshot

What happened

UMC told KCBD that around 10 a.m. Central on Thursday, September 26, 2024, an IT outage forced local and regional diversion of incoming emergency and non-emergency ambulance patients while the system investigated ransomware. Inpatient care and many walk-in access points stayed open, but phones, patient-portal messaging, and core clinical systems were disrupted for days.

In its November 22, 2024 substitute notice (PDF), UMC said a criminal accessed certain network systems, may have copied files, then deployed ransomware that made systems unavailable. UMC restored access, began mailing letters on November 22, 2024, and opened a toll-free line (888-722-4828, weekdays 8 a.m.–6 p.m. CT per the notice).

Public recovery milestones reported by UMC and Lubbock Avalanche-Journal / USA Today network coverage:

Contemporaneous reporting described a multi-week clinical IT outage — not a same-day blip. UMC has not published a ransom payment or demand figure.

What’s new since 2024

Texas Attorney General: Texas law requires electronic breach reports when ≥250 Texans are affected. UMC’s November notice and HHS filing confirm a reportable event; we did not independently re-parse the OAG portal row for this article. Use the Texas OAG breach listing for filing dates and Texas-resident counts.

Court records: We did not include federal docket searches in this article (CourtListener API returned 401 Unauthorized from this environment).

Who is at risk

• Patients whose data categories appear in UMC’s notice: names plus possible SSN, DOB, address, diagnosis, insurance, provider, and treatment dates.
• Referring clinics and independent practices in Lubbock and the 400-mile trauma radius that depended on UMC for transfers, imaging, or hospitalist coverage during diversion.
• Vendors and business associates on shared infrastructure — contemporaneous reporting noted parallel outages at Texas Tech University Health Sciences Center; treat shared EHR / identity paths as one blast radius until contracts prove isolation.
• Employers and benefits teams fielding “is my hospital safe?” questions from staff in West Texas.

Lessons for Texas clinics and small businesses

Regional hospitals are concentration risk: one encryption event becomes 911 diversion, canceled procedures, and weeks of downtime charting. Clinics with flat networks, always-on VPN, or one backup copy online inherit the same failure mode at smaller scale.

Documented programs matter when Texans’ data is involved. SB 2610 may help limit exemplary damages for eligible businesses that maintain a documented cybersecurity program; not legal advice or a guarantee.

Practical parallels for ≤50-person offices:

• Offline or immutable backups with a tested restore, not just a cloud sync.
• Written downtime procedures (paper MARs, referral numbers, alternate lab send-outs).
• Patch and MFA remote access — VPN and Citrix remain common hospital entry paths in peer incidents.
• DMARC enforcement on your domain before attackers spoof “breach assistance” or “UMC billing update” messages.
• Vendor access reviews — disable dormant VPN accounts for imaging, billing, and IT support firms.

What to do

If you received a UMC letter in late 2024:

1. Use only 888-722-4828 or contacts in your letter — not a number from a fresh text or email.
2. Review explanation-of-benefits and provider statements for care you did not receive.
3. Place a credit freeze at Equifax, Experian, and TransUnion if an SSN was involved.
4. Watch for fake breach portals and medical-ID scams — see Have I Been Pwned trends.

If you run a Texas clinic or professional office:

1. Map who still has VPN or EHR vendor access; remove leavers and unused integrations.
2. Enforce phishing-resistant MFA on Microsoft 365 / Google Workspace admin and billing inboxes.
3. Publish p=reject DMARC (aligned SPF/DKIM) on every domain that sends patient or invoice mail.
4. Tabletop “Level 1 down” — where do ambulances and STAT labs go when the hub hospital diverts?

MFA: YubiKey and Google Authenticator

Ransomware encryption is not undone by MFA. Strong sign-in does reduce follow-on portal and payroll phishing after breach notices. Grades match our MFA support directory.

We did not find UMC-published staff Microsoft 365 MFA documentation naming YubiKey or Google Authenticator — do not assume admin mail matches MyChart controls.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited umchealthsystem.com on November 1, 2026. 100% is the ideal — UMC’s public mail and web posture is not there today. These scores measure domain configuration, not clinical cyber maturity inside the firewall.

Key findings:

• 79% overall (High Risk label on audit) — better than many Texas providers we score in the 40s, but −21 vs the 100% ideal for an organization mailing SSN-bearing notices.
• 40% Identity & Spoofing — room for spoofed “patient notice” or appointment mail from lookalike domains.
• 5% Transport Security — inbound mail may lack strict MTA-STS enforce / TLS-RPT posture.
• Proofpoint Enterprise hosting shows solid routing, but policy enforcement gaps (public audit notes DMARC subdomain issues) still matter for BEC after breaches.

Audit link: umchealthsystem.com

Blacklist and lookalike domains

Email blacklist check (public DoH, November 1, 2026): umchealthsystem.com clear on checked DNSBLs. A SPFBL note on a web/CDN IP is shared-infrastructure noise — do not treat it as proof the hospital sends spam.

DNS lookalike scan (BEC profile, registered signals only):

High-interest registered names (investigate; not proof the Sept 2024 attack used them):

Type umchealthsystem.com yourself before trusting breach or billing mail. Continuous monitoring: Cybersquat Domain Monitoring.

Related coverage

• Texas Tech HSC / Interlock reporting
• Texas healthcare breach dashboard
• Ransomware threat landscape
• MFA support directory
• HIPAA healthcare breach statistics

Check your domain free at audit.emailmenow.com, or see automated reports and monitoring.

Sources: UMC substitute notice PDF (Nov 22, 2024) · KCBD — diversion (Sep 26, 2024) · KCBD — largely restored (Oct 24, 2024) · Lubbock Avalanche-Journal — outage timeline · BleepingComputer — ransomware diversion · ClassAction.org — investigation closed Feb 19, 2025 · UMC patient portal / MyChart migration · Epic MyChart two-step verification help · Texas OAG breach reporting · HHS OCR breach portal. Independent EmailMeNow audit, blacklist, and cybersquat probes November 1, 2026. Domain scores: audit.emailmenow.com only.

SB 2610 may help limit exemplary damages for eligible businesses that maintain a documented cybersecurity program; not legal advice or a guarantee.