According to researchers from Michigan State University, Yale and Johns Hopkins, ransomware is now the leading culprit behind U.S. health data breaches.
Ransomware is malicious software that hijacks a victim's files or systems and holds them hostage for money. At least four Michigan hospitals have been hit in recent years, including Michigan Medicine, which had more than 55,000 patients affected. McLaren Health Care topped the list with 2.5 million records breached.
The study revealed nationwide, hackers have exposed 285 million patient records over the past 15 years.
John Jiang, professor of information systems at Michigan State University and the study's lead author, said cyber crooks are hunting for specific data.
"They're looking for Social Security numbers, driver's license, individual birthdays," Jiang outlined. "Because they could to use this information to commit fraud, or selling on the black market."
Jiang pointed out health care providers don't have a lot of cybersecurity resources, so he said it is crucial to protect the most sensitive information first, for example, setting up separate systems to handle personal information.
In 2024, ransomware was behind just 11% of health care breaches nationwide but it did the most damage, compromising about 70% of all patient records. The new research builds on earlier studies showing internal mistakes, not hackers, caused more than half of health care data breaches, including lost devices and misdirected emails.
Jiang warned such breaches can also pose serious risks to patients' health.
"This person is allergic to a certain medicine," Jiang suggested. "If the hackers mess up the system, or modified whatever information, that could cause a life-changing event."
The researchers urged federal regulators to require hospitals and insurers to report ransomware attacks, change how they measure breach severity to include care disruptions and track cryptocurrency to stop ransom payments.
get more stories like this via email
A new law on the books will help Hoosier renters saddled with an eviction on their record get some relief.
Senate Bill 142, which took effect July 1, includes a provision allowing automatic dismissal of an eviction with some exceptions. Research site Eviction Lab reported nearly 71,000 filings in Indiana in 2024.
Jenny Terry, senior attorney for the nonprofit Indiana Legal services, said the eviction cases most eligible for sealing are those where the tenant never faced a legal judgment resulting in eviction.
"The case is filed as soon as the tenant gets behind in rent," Terry explained. "But whether it's because of rental assistance or just with additional time, the tenant is able to get caught up, and so that case is resolved."
The presence of the legal record on a case is still viewed by some landlords as an eviction even when the tenant did not leave, Terry pointed out. She added it may work against tenants seeking new housing opportunities.
Supporters of the law say an eviction permanently showing on a renter's record has more severe consequences than records of credit card debt or bankruptcy filings, which are deleted after seven years. Terry noted Sen. Liz Brown, R-Fort Wayne, helped move the bill forward amid some backlash.
"There was definitely was some debate about some aspects of the bill as it went through the legislature, but by and large, this was a bipartisan effort," Terry observed. "We were pleased that the next step was able to be taken with regard to this moving eviction sealing forward."
Under the law, new eviction cases will be sealed automatically if they were dismissed, the tenant won the case, or the case was overturned on appeal. Older cases can be sealed upon request if no money is owed or the case involves a matter other than rent and is older than seven years.
Eviction Lab data showed nearly 29,000 eviction filings to date as of June 1, 2025. Anyone needing more information can log on to IndianaLegalServices.org.
get more stories like this via email
By Doug Livingston for The Marshall Project.
Broadcast version by Farah Siddiqi for Ohio News Connection reporting for the Marshall Project-Public News Service Collaboration
To appeal his conviction for burglary and related charges, James Bishop needed the legal papers a Jefferson County court clerk had mailed him in prison. But mailroom staff at Ohio's Noble Correctional Institution decided there were too many pages.
They gave Bishop two options: Have the legal documents destroyed, or pay $4.61 in postage to send them back to the court.
When he refused either choice, correctional officers labeled the more than 60 pages from the court "contraband" and charged Bishop with "abuse of the mail system." After filing a formal complaint, officers put Bishop in a lockdown cell for four days with a man accused of "inflicting harm on another inmate" and manufacturing a weapon, according to court and prison disciplinary records.
"I got a ticket for contraband," an incredulous Bishop told The Marshall Project - Cleveland after getting out of the segregation unit in April. "Yeah, for the court sending me mail."
As of mid-June, Bishop remains incarcerated, still waiting for the records he needs to appeal his conviction.
Prison walls shouldn't stop a person from appealing a conviction or alleging civil rights abuses while incarcerated. But a 2021 pandemic-era crackdown on drug smuggling in the mail has delayed or prevented basic legal documents from reaching people inside Ohio's 28 state prisons.
The rights to petition the courts, to due process, and attorney-client privilege are pillars of the American justice system. "Having policies that unnecessarily restrict that is a big problem, and that's true under the federal Constitution and our state constitution," said Ben Cooper, a Columbus attorney who successfully challenged how the state prison system is handling what used to be protected mail.
Access to information, including a person's own legal records - which are usually available online to the general public - is significantly restricted in Ohio prisons.
Incarcerated people might get a couple of hours a week to conduct research on a prison law library computer. However, there's no unfettered access to the internet to search for legal arguments or visit a court website to view case files. Instead, there's LexisNexis, a third-party legal research tool. It doesn't always show every time-stamped entry on a court docket, including prosecutorial motions and lower court judgments that, if responded to in time, could aid people convicted of crimes in future appeals.
That's why incarcerated people rely heavily on the mail. Under the enhanced scrutiny though, legal records can take weeks or months to arrive, instead of days. Public court records, now treated like regular mail, can be denied for delivery if they exceed five pages. Because these records are now scanned, letters previously handed over in person are sometimes delivered to the wrong person, have pages missing, or come with a bill for copying and printing costs.
The Marshall Project - Cleveland interviewed or reviewed lawsuits and official complaints filed since 2021 by 33 people confined in nearly half of Ohio's state prisons. They said staff violated their rights by opening and reading their legal mail. Prison disciplinary records showed that correctional officers punished those who criticized the mailroom or filed lawsuits claiming their mail was mishandled.
Staff at Marion Correctional Institution, for example, disciplined Chad Messenger twice in 2022 for "disobeying a direct order" and "use of telephone or mail to threaten, harass, intimidate or annoy another." He had repeatedly supplied the mailroom with stamped envelopes and postage funds to forward legal mail to his family instead of returning it to the courts or having it destroyed. Messenger even filed a court motion accusing a local county clerk of dereliction of duty.
The conduct reports, or prison rules violations, could be used against an incarcerated person when they seek an early release from prison.
"Sometimes our cases are determined on our behavior in here, as well as our past history," Messenger said of early release and parole requests. If the people rack up too many conduct reports, "it looks bad."
Incarcerated people who challenge the handling of their mail in court are rarely afforded attorneys. They represent themselves, often losing, based on judgments that grant the prison system the latitude to keep facilities secure and free from contraband.
"Courts have consistently held that the maintenance of prison security and prevention of contraband from entering the prison are 'legitimate penological' interests," U.S. Magistrate Darrell A. Clay ruled in February.
The state prison system adopted tighter restrictions for legal mail in 2021 to keep out paper dipped in hard-to-detect synthetic drugs.
Drug seizures traced to legal mail - a tiny fraction of drug activity documented by correctional staff - did fall sharply, from 165 seizures in the first half of 2021 to 35 total in the next three years. Overall drug seizures, however, have continued to climb.
"They're trying to say that they want to do this to prevent introduction of contraband and the drug problem," said Richard Whitman, who is incarcerated at Belmont Correctional Institution. It's "worse than it ever was with the previous legal mail policy."
Incarcerated people, advocates and defense attorneys say the 2021 legal mail policy is an unconstitutional violation of the attorney-client privilege. The Marshall Project - Cleveland found that judges regularly extend filing deadlines for incarcerated people who miss filing deadlines due to slow-arriving court mail. Even with deadline extensions, people suing the state prison system or trying to overturn convictions are left with days, not weeks or months, to prepare and respond to complex legal questions and arguments raised by judges, prosecutors and attorneys who defend state-employed correctional staff.
"All they do is lie to us, and spin us," said Jason Monaco, an incarcerated man who works in the law library at Noble Correctional Institution, where he helps others, like Bishop, fight for their mail. "These people do not care about the Constitution or anything it stands for."
Monaco is among dozens of incarcerated people suing state prison officials, wardens and mailroom staff for disobeying a 2024 court order to deliver all federal court mail with as little interference as possible.
And it's not just incarcerated people who are complaining. Last month, lawyers with the Ohio Justice & Policy Center alleged in a lawsuit that, despite their staff attorneys following the new rules, staff at 11 prisons have been opening their confidential letters to clients for months.
State prison officials declined to comment for this story due to pending litigation. Under oath in a lawsuit settled last year, a top corrections administrator defended new restrictions on legal mail as "pretty clear" and "narrowly constructed to go after a particular issue."
Regular mail, which generally cannot exceed five pages, is scanned on site or forwarded to a processing center in Youngstown, where a private company opens, reads and scans the mail to be delivered electronically on digital tablets. Legal mail must be opened in front of the addressee, checked for contraband and, if clean, handed over without being read.
In order to send legal mail, which, unlike regular mail, is certified as delivered and processed swiftly, the 2021 policy required attorneys and court staff to obtain a control number from the prison system. Each number expires in 21 days, can only be used once, and verifies legal mail when placed on the outside of an envelope.
Under the old policy, which larger prison systems in California and Texas also use, legal mail only needed the valid return address of a law office or court.
In the early days of Ohio's new policy, prison mailrooms lacked guidance on how to handle court mail, which generally involves publicly available entries on court dockets. A one-page memo in September 2021 directed all mailroom staff to process all court mail as regular mail. Unless court staff marked the mail as confidential and requested a control number, the letters would be opened, scanned and read before the incarcerated person knew it had arrived.
The narrower definition significantly reduced the volume of legal mail, slashing the pieces arriving in the months before the new policy from over 10,000 to less than 3,000 by the end of last year, according to state data filed in the Ohio Justice & Policy Center lawsuit.
State prison officials could allow defense attorneys and courts to send confidential legal mail directly to incarcerated people on their electronic tablets, which would cut out the paper altogether. But there's no immediate timeline to implement that solution.
Four years after the start of the 2021 policy, the Ohio Supreme Court and a smattering of county courts use control numbers, even though it takes additional staff, time and resources. Several courts, including Cuyahoga County Common Pleas, do not, which means the timely delivery of court mail depends almost entirely on where an incarcerated person was convicted.
"I handle a lot of the inmate mail, but not all of it," said Susan Ayers, chief of compliance for the Hamilton County clerk of courts office. "And I will tell you that we almost exclusively send control numbers on there. I always assumed that was for ease of routing."
Several court clerks surveyed by The Marshall Project - Cleveland pointed to the 2021 memo from prison officials stating that they don't need control numbers because they're not sending legal mail.
"We don't even know how to do that. We don't do that. We just file what the judges give us," said Alicia Anderson, office manager at the Jefferson County Clerk of Courts Office, which repeatedly mailed Bishop envelopes that the prison mailroom labeled as "contraband" because they "were too large to scan."
In June 2024, federal Judge Edmund A. Sargus Jr., of the U.S. Southern District of Ohio, approved an agreement between Ohio prisons Director Annette Chambers-Smith and El-Barseem K. Allah, whose federal court mail had been withheld by the mailroom at Southern Ohio Correctional Institution. All federal court mail would be treated as legal mail "whether or not it was assigned a control number," the agreement stated.
The Ohio prison system, however, is not consistently holding up its end of the bargain, according to multiple incarcerated people who have referenced the ruling in subsequent lawsuits. Bishop, for example, sent The Marshall Project - Cleveland a photo and scanned copy of mail from a federal courthouse in Cleveland. The mail was opened and read outside of his presence, then scanned and delivered with two pages missing.
"I know they are in contempt," Bishop said.
In a lawsuit deposition last year, Brian Wittrup, the chief of strategy and policy for state corrections, told attorney Robert Salem that he could not say how many prisons were adhering to Judge Sargas' order.
"It is up to 28 separate prisons and their leadership to enforce those things and know whether or not they're being followed," Wittrup said. "There's just no way for me to know every day if policy is being adhered to, and that's true of any policy we have."
Attorneys with the Ohio Justice & Policy Center say that despite using control numbers, staff at 11 prisons have in the past few months started opening, scanning and reading attorney-client legal mail. In their May lawsuit, they argue that effective legal counsel requires clients who "feel comfortable communicating fully and frankly with their attorneys."
While visiting the Lebanon prison, attorney Angela S. Larsen, a lead attorney on the Ohio Justice & Policy Center lawsuit, said the prison staff told her to give the warden copies of papers her client needed to sign.
"No, this is confidential," Larsen said. "They just don't seem to get it."
Doug Livingston wrote this article for The Marshall Project.
This collaboration is produced in association with Media in the Public Interest and funded in part by the George Gund Foundation.
get more stories like this via email
Contact
