A ransomware group called Anubis today took credit for a cyber attack on Signature Healthcare that caused widespread disruption at Brockton Hospital in Massachusetts.
Signature Healthcare on April 6, 2026 announced a cybersecurity incident forced the hospital to resort to downtime procedures, divert ambulances, and cancel chemotherapy appointments.
Anubis claimed responsibility for the attack on its data leak website, where it claims to have stolen 2 TB of “sensitive patient data” from Signature. The ransomware group gave Signature Healthcare seven days to pay a ransom in exchange for not releasing the data.
Signature Healthcare has not acknowledged Anubis’ claim and Comparitech cannot independently verify it. We do not know how much Anubis demanded, if Signature did or will pay a ransom, what data was compromised, or how attackers breached Signature’s network. Comparitech contacted Signature Healthcare and Brockton Hospital for comment and will update this article if they reply.
“Signature Healthcare and Signature Healthcare Brockton Hospital are currently responding to a cybersecurity incident that has affected certain information systems within our health system,” says an April 6 announcement on Signature’s website.
“We moved to down-time procedures to ensure high-quality patient care and safety. We are working with outside resources to help us investigate the incident and restore operations as quickly as possible.”
Who is Anubis?
Anubis is a ransomware group that first surfaced in late 2024. Its malware both steals data and lock down infected computer systems. Anubis operates a ransomware-as-a-service scheme in which affiliates pay Anubis to use its malware and infrastructure to launch attacks and collect ransoms.
Anubis has claimed responsibility for 68 ransomware attacks in total, 13 of which have been confirmed by the targeted organizations.
Six of Anubis’ confirmed attacks hit healthcare organizations. In addition to Signature, they include:
- Pound Road Medical Center (Australia) reported a November 2024 data breach
- Ambleside (NC) reported an August 2024 data breach
- Dermatology Associates of Concord (MA) reported a September 2025 data breach
- AllerVie Health (TX) reported an October 2025 data breach
- Mid-South Pulmonary & Sleep Specialists (TN) reported a November 2025 data breach
In 2026 to date, Anubis has taken credit for 27 ransomware attacks, of which three have been confirmed so far.
Ransomware attacks on US healthcare
Comparitech researchers logged seven confirmed ransomware attacks on US hospitals clinics, and other healthcare providers in 2026 to date. Besides Signature Healthcare, they include:
- Mt. Spokane Pediatrics reported a January 2026 data breach claimed by LockBit
- Pecan Tree Dental notified 13,300 people of a January 2026 data breach claimed by Sinobi
- University of Mississippi Medical Center reported a February 2026 data breach for which Medusa demanded an $800,000 ransom
- Lymphedeme Therapy Specialists reported a February 2026 data breach claimed by Inc
- Aroostook Mental Health Services reported a March 2026 data breach claimed by Qilin
- Rocky Mountain Care reported a January 2026 data breach claimed by Qilin
We’re monitoring another 75 such attack claims from this year that haven’t been confirmed yet.
Ransomware attacks on US hospitals, clinics, and other care providers can steal data and lock down infected computer systems. They can cripple critical systems and endanger the health, privacy, and security of patients. Infected hospitals and clinics must pay a ransom or else they can face extended downtime, data loss, and putting patients and staff at increased risk of fraud.
About Signature Healthcare and Brockton Hospital
Founded as Brockton Hospital in 1896, Signature Healthcare was formed in 2008. Signature now encompasses the hospital, a nursing school, and more than 150 affiliated physicians practicing in 15 locations across southeast Massachusetts.
