Blackwater Ransomware Group Claims Attack on Idaho Hospital, Disrupting Critical Services
A cybercriminal group known as Blackwater has taken responsibility for a ransomware attack on Minidoka Memorial Hospital in Rupert, Idaho, which disrupted hospital operations over Easter weekend (April 2026). The incident temporarily impaired medical imaging services, forcing the transfer of some emergency patients.
On April 17, 2026, Blackwater posted on its data leak site, claiming to have stolen 577 GB of data from the hospital and demanding an undisclosed ransom within a week. Minidoka Memorial Hospital acknowledged the cyber incident in an April 17 Facebook post, stating that affected systems would be fully restored by midnight on April 19. The hospital has not confirmed Blackwater’s claims, and details about the breach including whether a ransom was paid or how the attackers gained access remain unverified.
Blackwater, a relatively new ransomware group first detected in March 2026, has claimed responsibility for three attacks to date. Its malware both encrypts systems and exfiltrates data, with ransom demands tied to decryption and the deletion of stolen files. The group previously targeted Medical Park Hospitals Group in Turkey on April 12, 2026, though the hospitals denied the breach.
The attack on Minidoka Memorial Hospital is part of a broader surge in ransomware incidents targeting U.S. healthcare providers. In 2026 alone, researchers have tracked nine confirmed attacks on hospitals, clinics, and mental health services, including breaches at Brockton Hospital (Massachusetts), Aroostook Mental Health Services (Maine), and Elmwood Healthcare (Rhode Island). An additional 82 unconfirmed claims are under investigation.
Minidoka Memorial Hospital, a publicly owned facility, serves as the sole hospital and nursing home in Minidoka County, Idaho, employing over 250 staff. The full extent of the data compromise and the hospital’s response remain unclear.
Signature Healthcare, MA cybersecurity rating report: https://www.rankiteo.com/company/signature-healthcare-brockton-ma
Minidoka Memorial Hospital cybersecurity rating report: https://www.rankiteo.com/company/minidoka-memorial-hospital
"id": "SIGMIN1776702986",
"linkid": "signature-healthcare-brockton-ma, minidoka-memorial-hospital",
"type": "Ransomware",
"date": "4/2026",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"{'affected_entities': [{'industry': 'Healthcare',
'location': 'Rupert, Idaho, USA',
'name': 'Minidoka Memorial Hospital',
'size': 'Over 250 staff',
'type': 'Hospital'}],
'data_breach': {'data_encryption': 'Yes (ransomware encryption)',
'data_exfiltration': 'Yes (577 GB stolen)',
'sensitivity_of_data': 'High (healthcare data)'},
'date_detected': '2026-04-17',
'date_publicly_disclosed': '2026-04-17',
'date_resolved': '2026-04-19',
'description': 'A cybercriminal group known as Blackwater has taken '
'responsibility for a ransomware attack on Minidoka Memorial '
'Hospital in Rupert, Idaho, disrupting hospital operations '
'over Easter weekend (April 2026). The incident temporarily '
'impaired medical imaging services, forcing the transfer of '
'some emergency patients. Blackwater claimed to have stolen '
'577 GB of data and demanded an undisclosed ransom within a '
'week.',
'impact': {'data_compromised': '577 GB',
'downtime': 'Disrupted operations over Easter weekend (April 2026)',
'operational_impact': 'Forced transfer of some emergency patients',
'systems_affected': 'Medical imaging services'},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain',
'ransomware': {'data_encryption': 'Yes',
'data_exfiltration': 'Yes',
'ransom_demanded': 'Undisclosed',
'ransomware_strain': 'Blackwater ransomware'},
'references': [{'date_accessed': '2026-04-17',
'source': 'Blackwater data leak site'},
{'date_accessed': '2026-04-17',
'source': 'Minidoka Memorial Hospital Facebook post'}],
'response': {'communication_strategy': 'Acknowledged the incident in an April '
'17 Facebook post',
'remediation_measures': 'Affected systems fully restored by '
'midnight on April 19, 2026'},
'threat_actor': 'Blackwater',
'title': 'Blackwater Ransomware Attack on Minidoka Memorial Hospital',
'type': 'Ransomware'}