SSM Health Care Corporation, a major U.S. healthcare provider, was targeted in a cyberattack allegedly orchestrated by Owen Flowers, one of the two British teenagers charged in the UK for cybercrimes. The attack involved infiltration and attempted damage to SSM Health’s systems, potentially compromising sensitive healthcare data, operational integrity, or patient services. While the exact extent of the breach remains undisclosed, the involvement of a healthcare entity suggests high-risk exposure, including possible disruption to medical services, unauthorized access to patient records (e.g., personal, financial, or treatment-related data), or systemic outages. The attack’s connection to a broader campaign—including attempts against Sutter Health—highlights its coordinated and malicious nature. Given the critical role of healthcare infrastructure, such incidents can threaten patient safety, erode trust in the organization, and trigger regulatory penalties. The case’s international dimension (UK-US) and the defendants’ alleged ties to other high-profile attacks (e.g., Transport for London) underscore the severity of the threat.

The U.S. Department of Health and Human Services reported that SSM Health Insurance Company experienced a data breach on December 11, 2020. This breach affected 4,492 individuals and involved paper/films. There was no business associate present during the breach.