Recent reports from the United States highlight two very different cyber incidents — one affecting a major healthcare provider, the other involving a global financial platform.
While the industries differ, the underlying lesson is the same: cyber risk is no longer theoretical. It directly impacts operations, customers, and trust.
At CSB, we believe these cases offer important reminders for organisations of all sizes — not to create fear, but to reinforce the importance of preparation and resilience.
Case 1: Ransomware Disrupts Healthcare Services
A ransomware attack forced the University of Mississippi Medical Center (UMMC) to close roughly three dozen clinics and cancel elective procedures for multiple days.
Hospitals and emergency rooms remained open, but many systems — including electronic health records — were taken offline as a precaution. Staff had to revert to manual, pen-and-paper processes while investigators assessed the extent of the attack.
For patients requiring time-sensitive treatments such as chemotherapy, delays created stress and uncertainty. Officials confirmed they were working with the FBI and assessing whether sensitive patient data had been accessed.
This case highlights a critical point:
Cyber incidents are not just IT events.
They are operational disruptions.
In healthcare environments, system outages affect real people in real time. Even if backups exist, restoration takes time — and business continuity planning becomes just as important as cybersecurity controls.
Case 2: PayPal Data Exposure Through Application Error
In a separate incident, PayPal disclosed a data breach linked to an error in its PayPal Working Capital (PPWC) loan application.
Due to a coding error, a small number of customers’ personal information was exposed for nearly six months — from July 1 to December 13, 2025.
Exposed data included:
- Names
- Email addresses
- Dates of birth
- Phone numbers
- Business addresses
- Social Security numbers
The vulnerability was patched, affected passwords were reset, and impacted customers were notified. Some experienced unauthorised transactions, which PayPal refunded.
Unlike ransomware, this was not an external intrusion exploiting infrastructure. It was a vulnerability introduced through application code — and exploited before being detected.
This reinforces another reality:
Cyber risk does not always come from sophisticated attackers.
Sometimes it comes from small oversights in development and testing.
What These Incidents Have in Common
Although one case involved ransomware and the other a software flaw, they share several common themes:
- Operational Impact – Clinics closed. Financial transactions were affected.
- Sensitive Data Exposure – Patient information and personal identifiers were at risk.
- Detection Lag – Issues persisted before being identified and contained.
- Trust Implications – Public confidence is always tested after incidents.
These examples illustrate that cybersecurity must be integrated across operations, development, and governance — not isolated within an IT department.
Awareness Without Alarm
It is important to approach these cases with perspective.
Most organisations will not face the exact same scenarios. However, the underlying risks — ransomware, credential misuse, application vulnerabilities — are widespread across industries.
The goal is not fear.
The goal is readiness.
Organisations should consider:
- Regular backup testing and recovery drills
- Clear incident response planning
- Secure software development practices
- Ongoing vulnerability management
- Monitoring for unusual system behaviour
- Staff awareness training
Healthcare providers, financial institutions, education, manufacturing — all rely on digital systems to operate effectively. When systems go offline, operations follow.
A CSB Perspective
At CSB, we see two key takeaways from these incidents.
First, resilience is as important as prevention. Even well-resourced organisations can experience disruptions. The ability to restore services quickly determines the real impact.
Second, cybersecurity must extend beyond perimeter protection. Application security, identity controls, monitoring, and governance are equally critical.
Cybersecurity is not about eliminating risk entirely — that is unrealistic. It is about reducing exposure, detecting issues early, and responding effectively.
Incidents like these remind us that vigilance and preparation are part of modern business operations.
By strengthening technical controls, reviewing processes, and maintaining clear recovery plans, organisations can protect both their systems and the people who rely on them.