The New York Blood Center, one of the country’s largest nonprofit blood donation and distribution centers, has canceled appointments and blood drives after a cyberattack.
In a statement posted to its website Wednesday, the blood center said hackers attacked it with ransomware Sunday, significantly reducing its operations.
The group is still accepting blood donations, but is cautioning donors to expect longer wait times. It has no estimated timetable for fully restoring its operations.
Independent blood suppliers like the blood center, the largest in the New York City area, provide 60% of the U.S. blood supply, according to America’s Blood Centers, a nonprofit that represents blood donation centers across the country.
Ransomware is a type of cybercrime in which cybercriminals lock up an organization’s computer networks and demand a payment in bitcoin for a code or program to make them usable again.
For a victim organization, containing a ransomware attack often means taking computers offline and either working to rid each one of the malicious software or replacing devices entirely. Even if the victim pays, ransomware can be extremely disruptive.
The New York Blood Center has canceled eight blood drives scheduled for Friday and nine for Sunday over the attack, it announced Friday.
It was already under significant strain before the cyberattack.
Last week, it announced a blood emergency. A combination of factors, including winter travel and school breaks, has led to its supplies of types O and B blood dropping to levels that could only last one or two days.
Allan Liska, a ransomware analyst at the cybersecurity company Recorded Future, told NBC News that ransomware attacks against medical nonprofits and other sensitive organizations are now commonplace.
“We should be shocked by this latest attack, but we’ve seen ransomware groups hit food banks, children’s hospitals, and this isn’t even the first time a blood bank has been hit,” he said. “The threat actors behind ransomware attacks simply do not care who they starve or kill with their attacks.”
Ransomware is still a persistent problem, Liska said. Recorded Future recorded 4,634 publicly reported attacks in 2024 around the world, he said, up from 4,400 in 2023.