On December 21, 2023, Cherry Street Health Services — a Federally Qualified Health Center serving patients across 15 sites in West Michigan — discovered that unauthorized actors had accessed and potentially acquired files containing the protected health information of 184,372 patients.
The breach was the result of a ransomware attack. Cherry Street serves uninsured and underinsured patients, migrant farmworkers, and other vulnerable populations across Kent and Muskegon Counties. The patients whose data was exposed — their names, Social Security numbers, dates of birth, medical record numbers, diagnoses, and treatment information — are among the most vulnerable in the healthcare system.
Not sure where your FQHC stands today? Take our free security assessment to find out.
Cherry Street is not unusual. It is a representative example of what happens to an FQHC that has not been able to close the gap between its compliance obligations and its cybersecurity infrastructure. Understanding what went wrong — and what a protected FQHC looks like — is the lesson every community health center should take from this incident.
What Happened at Cherry Street
While Cherry Street's public disclosure does not detail every aspect of the incident, the breach characteristics are consistent with a well-documented ransomware attack pattern against healthcare organizations:
Initial access via phishing or credential theft. The most common entry vector for ransomware against FQHCs is phishing — a malicious email that captures staff credentials. Once inside the environment, attackers use those credentials to move laterally through the network, accessing additional systems and escalating privileges.
Reconnaissance period. Modern ransomware attacks involve weeks of silent reconnaissance before the encryption event. During this period, attackers map the network, identify where patient data is stored, locate backup systems, and stage data for exfiltration.
Double extortion. The attack appears to have involved data exfiltration before encryption — meaning the attackers copied patient data and threatened to publish it unless the ransom was paid. For an FQHC serving vulnerable populations, the threat to publish patient data creates extraordinary pressure.
Encryption event. The encryption event itself — locking production systems — forced Cherry Street to shut down or restrict operations at multiple sites while forensic investigation and recovery proceeded.
184,372 patients notified. HIPAA required notification to every individual whose data was potentially exposed. At $15–$25 per patient for notification and credit monitoring, the notification process alone represents a $2.7–$4.6 million expense — for an organization whose annual budget is a small fraction of that.
The Specific Security Failures That Made This Possible
Based on the characteristics of similar FQHC ransomware incidents and the attack pattern described above, the contributing security gaps at organizations like Cherry Street typically include:
No behavioral endpoint detection (EDR). Standard antivirus cannot detect the lateral movement and data staging that precede ransomware detonation. Behavioral EDR, which monitors process behavior rather than matching signatures, would have flagged the reconnaissance activity before the encryption event.
No 24/7 security monitoring. Ransomware attacks are timed for periods of low IT staffing — nights, weekends, holidays. A 24/7 SOC watching for anomalous behavior is the primary defense against attacks timed to avoid human oversight.