UIC Confirms Ransomware Hit on College of Medicine Servers

Key Takeaways

• Unauthorized actors obtained data from UIC College of Medicine servers during a ransomware incident.
• UIC’s main network and UI Health patient care were not affected, according to the university.
• Investigators are still determining whether personal, academic, or research information was compromised.

UIC has confirmed that unauthorized actors obtained data from servers belonging to its College of Medicine during a ransomware incident, moving the episode beyond a disruption involving unavailable systems. The remaining question is what information was taken and whether its exposure triggers notification or regulatory obligations.

Some College of Medicine systems were temporarily unavailable after the incident. UIC said its main university network was not affected, and UI Health patient care continued without disruption. That separation matters because it suggests the intrusion was contained within a defined technology environment rather than spreading broadly across UIC’s infrastructure.

Still, limited operational impact does not mean limited data risk. Investigators are working to determine whether the obtained material included personal, academic, or research information. UIC has not disclosed the volume of data involved, identified the ransomware group, reported a ransom demand, or said whether a payment was considered.

In the general cybersecurity sense, unauthorized actors obtained data, which supports describing the event as a breach of College of Medicine servers. But the scope of that breach remains unresolved. UIC has not yet established whether regulated personal data, protected health information, research records, or other sensitive material was among the information taken.

That distinction will shape what happens next. If investigators identify protected health information, obligations under the HIPAA Breach Notification Rule could become relevant, depending on which UIC entity controlled the data and the circumstances of the exposure. Other categories of personal information could bring state breach-notification requirements into play. Academic and research records may create a different set of contractual, ethical, and funding-related concerns.

Medical colleges occupy an unusually complicated technology environment. They can hold student files, faculty records, grant documentation, laboratory data, intellectual property, clinical research information, and systems connected to healthcare operations. An incident can therefore create consequences well beyond the restoration of encrypted servers, even when direct patient care remains available.

The wider threat environment helps explain the concern. Comparitech recorded 445 ransomware attacks involving healthcare providers in 2025. Of those, 155 were confirmed, affecting more than 10.1 million known records. The average ransom demand was $615,000.

Separate 2025 findings indicate that 36% of healthcare providers paid a ransom. Median demands fell 91% year over year to $343,000, while median payments declined to $150,000. Lower payments may suggest stronger resistance to extortion, but attackers can still profit from stolen data, follow-on fraud, and pressure generated by threatened publication.

Healthcare was also the most targeted U.S. critical-infrastructure sector in 2025, with 460 ransomware attacks reported to the FBI’s Internet Crime Complaint Center. Data compiled from federal breach reporting and discussed by The HIPAA Journal indicates that healthcare breaches continued to affect tens of millions of people, with hacking and IT incidents remaining the dominant category.

Recent campaigns have reinforced the business model. The Change Healthcare attack demonstrated how disruption at a connected healthcare intermediary can cascade across payments and clinical administration. ALPHV/BlackCat became closely associated with that incident, while groups including INC, Qilin, and RansomHub have remained part of the broader ransomware landscape. UIC has not attributed its incident to any of these specific groups.

For UIC, the immediate work centers on forensic scoping, credential review, server restoration, log analysis, and identification of affected records. Investigators must also examine whether the attackers maintained persistence or accessed connected environments before containment. Until the university answers what data was actually obtained, the financial, legal, and reputational exposure remains difficult to measure.

The incident demonstrates the value of network segmentation, which appears to have limited the operational reach of the attack given UIC’s statement that its main network and UI Health patient care were unaffected. Yet segmentation alone does not prevent unauthorized data access. Detailed asset inventories, protected backups, and clear ownership of research and academic data are required to determine breach impact. UIC’s next disclosure will be the more consequential one: whether the stolen data can be tied to identifiable people, sensitive research, or regulated records.