Second French hospital forced to relocate patients after cyber attack this year
The hospital shut down its network as a precaution after a south Parisien hospital had to do the same in August
A hospital in France has been hit with a cyber attack and been forced to move patients out of its facility, the second case of its kind in the country this year.
The attack hit the André Mignot hospital in Versailles on Saturday 3 December, according to the Agence régionale de santé (ARS) Île-de-France, France’s regional health service, prompting it to shut down its network as a security measure.
It said that no other health facility had been impacted by this cyber attack. The National Authority for Security of Information Systems (ANSSI), the agency in charge of the country’s computer security, is also carrying out an investigation into the incident.
“Cyber criminals know that hitting patient services and business availability is the most effective way to gain a ransom payment,” said Simon Chassar, CRO at Claroty. “The healthcare industry is one of the few sectors where cyberattacks can fatally impact human life, and threat actors know this.
“They want to put decision-makers in a morally impossible situation so that they have no choice but to pay ransoms in order to get their services back up and running. Unfortunately, situations like this are likely to increase as healthcare providers add more cyber-physical systems to their networks.”
André Mignot was forced to transfer some patients to other hospitals and is only accepting a limited number of new patients. In case of an emergency, patients are advised not to go to the site but dial 15 to reach the French Medical Services (SAMU) instead and receive instructions on where to go. ARS said it’s on-site and organising continuity of care and management of patients at a regional level with the SAMU.
The hospital has also enacted emergency measures including a “white plan”, where hospitals can reorganise internal spaces or transfer patients to other services, as well as pushing back the date for operations that are less urgent. It has also partially paused its operating theatre activities.
RELATED RESOURCE
Accelerating healthcare transformation through patient-centred medtech solutions
Seize the digital transformation opportunities to streamline patient care and optimise patient outcomes
ARS Île-de-France has advised other healthcare establishments in the region to be vigilant in case there are more cyber attacks. The agency has also created a crisis unit to allow it to monitor the situation, support its teams, and coordinate care between hospitals.
The attack on André Mignot follows a similar incident from August 2022 when the LockBit ransomware group was thought to have attacked a hospital near Paris and demanded a ransom of $10 million.
The cyber attack was confirmed to have occurred on 21 August by the Center Hospitalier Sud Francilien (CHSF) and was reported to have been forced to turn patients away too.
-
Shifting from traditional MDR to an AI-powered agentic SOCAs autonomous threats proliferate, relying on standalone AI tools is a major business risk. Here is how Arctic Wolf is setting the market standard to solve the AI trust problem
-
Tokenmaxxing means FinOps is more important than everNews With firms facing surging AI bills, FinOps techniques are more important than ever
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
