Fenway Health's computer systems went offline Friday, September 11, knocking out the Boston clinic's internal pharmacy software and forcing staff to send patients to on-call providers for emergency prescription fills elsewhere. The Federally Qualified Health Center, which serves more than 30,000 patients including longtime Fenway residents and LGBTQ+ patients across the Boston area, has spent the days since scrambling to limit the fallout for people who depend on it for care.
According to Universal Hub, patients were instructed to bring exact dosage details to outside clinics so they could secure their medications while Fenway's own pharmacy system remained down. As reported by Axios, Fenway Health experienced what it is calling an IT incident, and the health center has declined to confirm whether it experienced a cyberattack. A message posted to Fenway Health's website said the organization continues to respond to an IT incident, though that notification had been removed from the site by Sunday.
A Fenway Health spokesperson, in an emailed statement to Axios, described the incident as an interruption to IT systems and said the organization has taken multiple steps to limit impacts to patient care. The clinic's sexual health services were closed on Friday, and Fenway Health said patients should expect delayed MyChart messaging and callbacks as the center works with external IT experts toward resuming full operations. Ryan Dunn, per Axios, did not respond to questions about when the incident was first detected, its effects on appointments and MyChart correspondence, or whether patient data or other sensitive information was compromised.
A Pillar of LGBTQ+ Health Care Since 1971
Fenway Health traces its roots to 1971, when it began as a student-led basement drop-in clinic; the organization went on to diagnose New England's first case of AIDS in 1981, according to background compiled by Wikipedia. It has since grown into a Federally Qualified Health Center with a budget exceeding $100 million, headquartered at Boston's Ansin Building. The center's central Boston facility at 1340 Boylston Street also houses the Sidney Borum, Jr. Health Center for at-risk youth and the Violence Recovery Program, which serves LGBTQ+ victims of domestic violence and bias crimes, according to Fenway Health.
Those specialized programs, serving some of the region's most vulnerable patients, are part of Fenway Health's broader care offerings. The outage lands amid a broader wave of cyber disruptions hitting Massachusetts institutions in the same stretch of days. Springfield Public Schools closed all district facilities and sent more than 23,000 students home following a network cyber incident, marking the district's second operational shutdown from cyber threats since a 2020 ransomware attack, as Hoodline previously reported.
Municipal Systems Also Knocked Offline
Everett City Hall closed its municipal offices after a cybersecurity incident compromised city computer systems, coming shortly after Andover's municipal and school networks suffered a four-day attack in August that knocked out local government email and billing systems, according to Hoodline's coverage of that shutdown. Taken together, the Fenway, Springfield and Everett incidents are separate disruptions affecting Massachusetts health, public-school and municipal systems.
What Happens if Patient Data Was Exposed
Federal law sets a clear timeline for healthcare providers if investigators confirm a breach. Under the HIPAA Breach Notification Rule enforced by the U.S. Department of Health and Human Services, covered providers must notify federal regulators and affected individuals within 60 calendar days of discovering a breach affecting 500 or more patient records. The article does not detail Massachusetts law's notification requirements.
The incident also arrives amid a documented surge in cyberattacks targeting the healthcare sector nationally. Healthcare was the most targeted critical infrastructure sector in 2025, suffering 460 ransomware attacks and 182 data breaches for a combined 642 cyber events, according to FBI internet crime data analyzed by the American Hospital Association. Global healthcare ransomware attacks climbed further in the first half of 2026, rising nearly 14% from the prior half-year period, with 225 attacks recorded in the United States, per tracking cited by Gallagher Bassett. Separate data released by the American Hospital Association found that more than 80% of protected health information stolen from healthcare entities in 2025 was exfiltrated through third-party vendors and business associates rather than directly through primary hospital systems.
Fenway Health has not said when its systems will be fully restored, and Dunn has not responded to multiple questions from Axios about the scope or timeline of the disruption. For now, patients seeking prescriptions or MyChart responses are being told to expect delays as the center's IT team and outside experts continue working to bring operations back online.
