Montgomery (W.Va.) General Hospital CEO Deborah Hill said the health system was hit with a ransomware attack on March 1, BankInfoSecurity reported April 4.
On Feb. 28, the health system detected malware activity on its IT systems.
On March 1, Ms. Hill said the health system learned that it had been hit by ransomware attack and began working with a security firm to launch an investigation.
Hospital officials learned that the cyberattack began with a phishing email that led to a ransomware attack that locked the hospital's legacy servers.
The servers contained the hospital's budget documents, cost reports and payments to vendors, according to Ms. Hill.
Montgomery General Hospital was then contacted by the D#nut Leaks ransomware gang demanding $750,000 for the decryption and deletion of files it had exfiltrated.
"We could have attempted to pay the ransom, but the data was so old that it wasn't worth paying," Ms. Hill told the publication.
The hospital's EHR system was not affected by the attack.
Ms. Hill said some of the hospital's data was posted on a leak site dubbed "Donut Leaks."
Ms. Hill did not specify what kinds of patient information was compromised, but said that those whose Social Security numbers were breached would be provided complimentary credit and identity monitoring.
Ms. Hill did not mention how many patients were affected.