Rhysida Healthcare Ransomware: The 337K Cookeville Playbook

What Happened at Cookeville

Cookeville Regional Medical Center (CRMC), a Tennessee regional hospital, detected a network intrusion on July 14, 2025. Investigation revealed that files had been stolen in the days prior. The attacker was the Rhysida ransomware gang, which claimed responsibility on its leak site, and which exfiltrated approximately 500GB of data before being detected.

On April 14, 2026 — nine months after detection — CRMC began mailing breach notification letters to 337,917 individuals. The compromised information, per the hospital’s filing, included names, dates of birth, addresses, Social Security numbers, driver’s license numbers, financial account numbers, medical treatment information, and health insurance policy details.

Rhysida initially listed the data for sale at 10 bitcoin (roughly $1M at the time). When no buyer materialized, the group made the stolen dataset freely available for download — a pressure pattern the gang uses to punish non-payment and to maintain credibility in the ransomware ecosystem.

Rhysida claimed 91 attacks across all sectors in 2025, with 23 confirmed and an average ransom demand of $1.2M, according to breach-tracking analyses.

Who Rhysida Is

Rhysida is a ransomware-as-a-service (RaaS) operation that recruits affiliates who run intrusions using the Rhysida strain in exchange for a cut of ransom payments. CISA, the FBI, and HHS jointly profiled the group in advisory AA23-319A in late 2023. Since then:

• Primary sectors: education, government, manufacturing, and technology, with sustained secondary focus on healthcare and public health.
• Method: double extortion — encrypt to extort, then publish or sell stolen data if payment is refused.
• Pressure tactic: a seven-day publication window to force rapid payment decisions.
• Entry vectors: phishing, Remote Desktop Protocol brute force, exploitation of unpatched perimeter devices (VPN gateways, firewalls), and malicious search engine ads that deliver trojaned installers.

Healthcare remains a prime target because hospitals cannot afford extended downtime, patient safety is directly at risk, and most hospital IT budgets are materially below the sector’s risk profile.

The Nine-Month Notification Gap

The public issue with the Cookeville case is not that the breach happened — it is that notification took 270 days from detection to letter. Under US HIPAA breach notification rules (45 CFR § 164.400-414), covered entities have 60 days from discovery to notify affected individuals. The gap reflects a common pattern:

• Forensic investigations outrun the 60-day clock. The original “discovery” date is often legally contestable.
• Delayed notification compounds reputational and regulatory damage.
• By the time patients learn their SSN and medical records are on a leak site, the data has already circulated in criminal markets for months.

For global healthcare CISOs, the lesson is that the ransomware clock does not start at notification — it starts at intrusion. Detection speed, not disclosure speed, is the variable under your control.

The Healthcare Defender Playbook

Drawing from CISA AA23-319A, HHS HC3 alerts, Barracuda’s Rhysida analysis, BlackFog’s incident tracking, and 2026 HIPAA guidance:

Prevention (pre-intrusion):

1. Patch internet-facing systems aggressively. VPN gateways (Fortinet, Cisco, Ivanti), firewalls, and RDP-exposed hosts are the top three Rhysida entry points.
2. Multi-factor authentication everywhere. Webmail, VPN, and any system that reaches clinical data. Single-factor VPN is Rhysida’s favourite door.
3. Network segmentation. Isolate EHR, imaging (PACS), lab systems, and biomedical OT from general IT. A flat hospital network is a ransomware accelerator.
4. Kill search-ad installers. Train staff not to install software from search-engine ad results. Use application allowlisting on clinical workstations.
5. Offline, tested backups. Not just “backups exist” — tested restores, immutable copies, and offline media. Rhysida’s affiliates routinely target backup servers.

Detection (during intrusion):

1. EDR on every endpoint. CrowdStrike, SentinelOne, Defender for Endpoint with active response enabled. Detect LOLBin abuse, credential dumping, and unusual archive creation (the 500GB staging step).
2. Egress monitoring. A hospital should not normally exfiltrate 500GB to an external host. DLP and network anomaly detection catch this if tuned.
3. SIEM correlation and 24/7 SOC coverage. Most regional hospitals still run business-hours SOCs. Rhysida exploits nights and weekends.

Response (post-intrusion):

1. Rehearse the breach response plan with legal, communications, clinical leadership, and external counsel. Meet HIPAA 60-day notification windows or document the forensic reason you cannot.
2. Do not assume a silent response. Rhysida will leak the data if you do not pay; paying does not guarantee the data stays private. Build the public-response playbook as if leaked.

What Global Healthcare Systems Should Take Away

Rhysida is not a sophisticated zero-day shop. The Cookeville intrusion is a case study in what unsophisticated ransomware does to an under-defended hospital: phishing or RDP entry, lateral movement, exfiltration, encryption, extortion, leak. Every control in the playbook above is standard — the gap is consistent execution across every hospital IT estate.

For non-US healthcare systems watching from Europe, Africa, and the Middle East: Rhysida does not care about borders. The same group has claimed victims in the UK, France, and Australia. The playbook ports cleanly, and the seven-day leak timer is universal.

Sources & Further Reading

• Cookeville Hospital Discloses Rhysida Breach Hitting 337,917 — Infosecurity Magazine
• Data Breach at Tennessee Hospital Affects 337,000 — SecurityWeek
• Ransomware Attack on Cookeville Regional Medical Center — HIPAA Journal
• #StopRansomware: Rhysida Ransomware — CISA AA23-319A
• Rhysida Ransomware: Recent U.S. Breaches and Mitigation — BlackFog
• Cookeville Regional Medical Center Hospital Data Breach — Security Affairs