A ransomware attack targeted Ballarat Health Services, a regional hospital in Australia, disrupting critical healthcare operations. The attack encrypted patient records, medical imaging systems, and administrative databases, forcing the hospital to revert to manual processes for emergency and routine care. Staff were unable to access electronic health records (EHR), leading to delays in surgeries, diagnostic procedures, and medication administration. The hospital’s IT team isolated infected systems to prevent lateral spread, but the outage persisted for 48+ hours, causing cancellations of non-emergency surgeries and diverting ambulances to neighboring facilities. The attackers, leveraging a double-extortion tactic, exfiltrated sensitive patient data—including medical histories, insurance details, and personally identifiable information (PII)—before encrypting files. They threatened to leak the data unless a ransom was paid. While the hospital refused to negotiate, the incident triggered a state-level cybersecurity investigation, regulatory fines for HIPAA/GDPR-like violations, and long-term reputational damage. Recovery efforts involved restoring from offline backups, but some data remained corrupted, requiring months of reconciliation. The financial impact included ransomware mitigation costs, legal penalties, and lost revenue from disrupted services, estimated in the millions of dollars.