Ransomware Attack Disrupts Critical Services for 100+ Nursing Home Providers A ransomware attack on Virtual Care Provider Inc. (VCPI), a Milwaukee-based technology firm, has severely disrupted operations for over 110 nursing home and long-term care organizations across 45 states. The attack, detected on November 18, encrypted servers and cut off access to patient medical records, internet services, payroll systems, and medication ordering for facilities relying on VCPI’s cloud hosting and security services. Hackers deployed Ryuk ransomware, spread via the TrickBot virus, and demanded a $14 million Bitcoin ransom. VCPI estimates 20% of its servers were compromised, affecting 80,000 computers used by its clients. The company has engaged a third-party cybersecurity firm to assist with recovery, prioritizing systems for electronic health records (EHR), email, and active directory access. VCPI president Zachary Koch confirmed the attack as a "highly sophisticated" incident, stating the company is working to restore operations while enhancing security measures. CEO Karen Christianson warned of life-threatening risks for patients if critical data remains inaccessible, noting that some facilities may face closure if billing systems aren’t restored in time. One small assisted living facility risks shutting down by December 5 if Medicaid billing isn’t processed. The attack mirrors recent Ryuk ransomware incidents targeting healthcare providers, including a French hospital forced to revert to manual record-keeping and an Alabama health system that paid hackers for decryption keys. Cybersecurity experts attribute the attacks to unpatched vulnerabilities like EternalBlue and BlueKeep, emphasizing that many victims fail to implement basic security updates. VCPI has stated it cannot afford the ransom demand, leaving affected facilities to navigate prolonged disruptions in care and administrative functions. The investigation remains ongoing.

Virtual Care Provider Inc. learned about a data breach that had almost completely compromised all of its key services, including email and Internet access, medical records, client billing and phone systems, and even VCPI's own payroll processes. Unknown intruders infected VCPI's networks with the Ryuk ransomware strain, encrypting all customer data hosted by the company and requesting a staggering $14 million ransom in exchange for the cryptographic key required to restore access to the files. The organisation claimed that it is unable to pay the ransom demand, which is equivalent to $14 million worth of Bitcoin, and warned that if VCPI is unable to recover from the attack, some of its clients may soon have to close their doors.