Fraud Management & Cybercrime , Incident & Breach Response , Ransomware
Hacked French Hospital Suspends Emergency Operations
6 Patients Transferred; 'Total Reorganization' Ongoing, Says Health Minister
A French hospital suspended emergency operations and transferred some patients after a weekend cyber incident.
See Also: Ransomware Response Essential: Fixing Initial Access Vector
The André Mignot hospital, located in Le Chesnay in the outskirts of Paris, took its network offline Saturday evening after spotting the attack, French regional health agency Agence Régionale de Santé said on Sunday.
The hospital is accepting only a "limited" number of new patients. Local government agencies, the ARS and Minister for Digital Transition and Telecommunications Jean-Noël Barrot advised emergency cases to avoid the hospital, as well as affiliated medical center Richaud Hospital. The two centers and the Despagne Retirement Home together make up the larger Hospital Center of Versailles.
The attack does not appear to have spread beyond André Mignot. "To date, no other health facility in the region has been impacted," the ARS said. The National Authority for Security and Defense of Information Systems is investigating. A crisis unit is monitoring the situation and coordinating care in conjunction with the region's other medical centers.
The cyberattack had led to a "total reorganization of the hospital" said François Braun, minister of social affairs and health, reported the Agence France-Presse.
Barrot condemned the attack in a tweet, declaring, "Shame on the criminals who prey on the most vulnerable." The Paris Cyber Prosecutor's Office is looking into the incident, and the French gendarmerie will investigate and assist in remediation, Barrot said on French cable news network BFM TV.
Barrot and Braun visited the hospital complex Sunday evening. Braun also condemned the incident, tweeting, "Taking the health of the French hostage is inadmissible."
Braun told reporters that six patients had been transferred by Saturday evening - three from intensive care and three from the neonatal unit, and a few others were in line for transfer. The hospital called in extra staff to the ICU to observe patient monitoring systems since the machines themselves were operational but the local network wasn't, Braun also said, the AFP reported.
A similar incident at a different suburban Paris hospital took place in August. The 1,000-bed Centre Hospitalier Sud Francilien in Corbeil-Essonnes underwent a cyberattack and received a $10 million ransom demand from a group later identified as working with the LockBit ransomware. The center's refusal to pay extortion led hackers in late September to publish nearly 12 gigabytes of patient and staff data (see: LockBit Publishes Stolen Data as Hospital Rejects Extortion).
It is unclear if André Mignot is also undergoing a ransomware attack. The hospital did not respond to Information Security Media Group's request for additional details.
