Virtual Care Provider: Ransomware Locks 100+ Nursing Homes Out of Critical Systems

"Virtual Care Provider (VCP), a Milwaukee-based IT services company that supports long-term care facilities, has told clients that a ransomware attack has locked more than 100 nursing homes out of patient records…"

Virtual Care Provider (VCP), a Milwaukee-based IT services company that supports long-term care facilities, has told clients that a ransomware attack has locked more than 100 nursing homes out of patient records, payroll systems and medication ordering, according to KommandoTech. The outlet reports that about 20% of VCP's servers are affected, that the attackers want $14 million, and that VCP does not yet know whether client data was taken. One caveat matters here. In the material reviewed for this brief, only one source covers the incident: a single OTHER-tier report that relays VCP's statements to clients and second-hand claims made to the Milwaukee Journal Sentinel. We have found no regulator filing, breach-portal entry or public statement from VCP itself. Every figure below is attributed to that report and should be read as reported, not independently confirmed.

What Happened

KommandoTech reports that VCP told its clients about the attack the day after it found it. The report does not give a discovery date. Its account:

Scope: More than 100 nursing homes that depend on VCP's hosted services lost access to core systems.
Infrastructure impact: About 20% of VCP's servers were affected "so far," which suggests encryption may still have been spreading or being assessed when VCP made the statement.
Ransom: The attackers are reportedly demanding $14 million to give back control of VCP's systems.
Operational fallout: VCP CEO Karen Christianson is quoted as saying some facilities cannot access patient records or order medication, and some doubt they can run employee payroll.
Response: VCP says it has opened an internal investigation and is working to estimate the damage, restore systems and strengthen its defences.

The report does not name a ransomware family or threat actor, and VCP has not publicly attributed the attack.

Editorial note on provenance: The reported details closely match a widely covered November 2019 Ryuk attack on the same company: the same CEO, the same $14 million demand and the same 100+ facilities. The "60 Minutes in August" reference in the source also fits that period. Readers should treat the October 2026 date of this coverage carefully until VCP or a regulator confirms a new incident.

What Was Taken

As of the KommandoTech report, VCP says it does not know whether client data was compromised. No record count, data types or exfiltration claim has been published, and no leak-site listing appears in the sources reviewed.

Recent healthcare incidents show why "unknown" should not be read as "none." In comparable environments, attackers have routinely copied data before or instead of encrypting it:

Veradigm stated in its September 8, 2026 Form 8-K that a threat actor used credentials taken from a third-party vendor to copy patient data, which for some patients included Social Security numbers. The company says clinical and medical information was not involved. HIPAA Journal reports that the group The Gentlemen listed Veradigm on its leak site on September 5. Veradigm itself has not named the actor.
zHealth, an EHR and practice-management vendor, told Oregon's attorney general that 118,563 people were affected, according to BreachHistory. The copying happened January 20-21, 2026, but the company says it only became aware around June 15. That five-month gap is a reminder that the scope of a breach is often found long after the encryption event.
AdaptHealth has confirmed that 4.1 million people were exposed in a July attack attributed to ShinyHunters, according to HackWire, citing BleepingComputer.

A nursing-home IT provider holding medication orders, patient charts and payroll data would hold exactly this kind of sensitive data: health information and staff financial details. If exfiltration is later confirmed, HIPAA notification obligations would likely pass through VCP to each affected facility.

Why It Matters

Concentration risk in the long-term care supply chain. One managed service provider is a single point of failure for more than 100 facilities. Most of those facilities have little in-house IT and no way of running independently once their hosted environment goes down. One intrusion turns into a regional care-delivery outage.

Patient-safety impact, not just data impact. Losing medication ordering in a nursing home is a clinical problem, not only an administrative one. KommandoTech cites FBI cyber division section chief Mike Christman as saying attackers focus on healthcare and government precisely because the stakes push victims to pay.

Third-party compromise is the dominant 2026 pattern. The surrounding incidents show the same weak point again and again:

Veradigm's exposure came through a vendor's environment (SEC 8-K, HIPAA Journal).
WindRose Health Network, which is notifying 33,158 people, was breached through a previously unknown vulnerability in a vendor's remote access tool, according to HIPAA Journal.
Blueberry Pediatrics and its prescription provider Photon Health were both hit by separate actors exploiting the same Metabase zero-day, according to Almeida Law Group.

The VCP incident fits that pattern: the nursing homes were not breached directly, but the vendor they all depend on was.

Recovery is slow. Luminis Health's October 8 update says its systems are restored but the investigation is still open and notification decisions are pending. Restoring operations and confirming what was taken run on separate timelines, often months apart.

The Attack Technique

VCP has not disclosed how the attackers got in. The only reported clue is second-hand. Cybersecurity firm Hold Security told the Milwaukee Journal Sentinel that Russian hackers had targeted VCP with malicious email attachments for more than 14 months, according to KommandoTech. That claim rests on one OTHER-tier report relaying a third party's statement to another outlet. It has not been confirmed by VCP or law enforcement.

If accurate, it points to a familiar sequence: a phishing-delivered loader gives the attacker a foothold, the attacker moves laterally through the MSP environment for weeks or months, and then deploys ransomware widely across hosted client infrastructure. The reported 20% server impact fits an encryption run that was either partial or still under way.

Other access routes seen across this year's healthcare incidents include:

Stolen API and service credentials taken from vendor environments (Veradigm 8-K)
Zero-days in remote access tools used by vendors (WindRose, per HIPAA Journal)
Zero-days in exposed business intelligence platforms (Metabase at Blueberry and Photon, per Almeida Law Group)
Long undetected dwell time before discovery (zHealth, per BreachHistory)

What Organizations Should Do

Plan downtime procedures for vendor loss, not just your own. Nursing homes and clinics should keep current offline medication administration records, paper ordering workflows and a direct pharmacy contact path that do not depend on the hosted EHR. Test them on a schedule.
Require MSPs and hosted-EHR vendors to prove segmentation and backup integrity. Ask for evidence that client environments are isolated from each other, that backups are immutable and offline, and that restore times have been tested. Write those requirements into contracts, along with breach-notification deadlines.
Harden email against malicious attachments. Block or sandbox macro-enabled Office files, ISO/IMG/LNK containers and archive attachments from external senders. Treat a long-running phishing campaign against your organisation, like the one Hold Security described, as an active intrusion attempt and not background noise.
Rotate and scope vendor credentials and API keys. The Veradigm incident shows that credentials stored in a vendor's environment can be used against you. Enforce short-lived tokens, IP allowlisting and per-customer scoping for service APIs, and watch for unusual bulk data pulls.
Patch and restrict exposed remote access and analytics tools. Inventory every vendor remote access tool and every internet-facing BI or reporting platform, such as Metabase. Put them behind VPN or zero-trust access, and subscribe to vendor advisories so zero-days can be patched within days.
Hunt for dwell time before you assume containment. After any ransomware event, assume exfiltration until forensics proves otherwise. Review outbound traffic, cloud storage access and archive-creation activity going back several months. zHealth's five-month gap between copying and awareness is the benchmark to beat.

Sources: Hackers target 100+ nursing homes in ransomware attack | Veradigm Inc. Form 8-K filed September 8, 2026 | Veradigm Discloses Third Party Data Breach as Hackers Threaten to P... | WindRose Health Network Discloses Data Breach Affecting 33K Individ... | Blueberry Pediatrics Data Breach Investigation Almeida Law Group | AdaptHealth confirms 4.1 million people exposed in July cyberattack... | Luminis Health Cybersecurity Incident Update | zHealth Breach Affects 118,563 Patients and Insureds — BreachHistory