Second French hospital forced to relocate patients after cyber attack this year
The hospital shut down its network as a precaution after a south Parisien hospital had to do the same in August
A hospital in France has been hit with a cyber attack and been forced to move patients out of its facility, the second case of its kind in the country this year.
The attack hit the André Mignot hospital in Versailles on Saturday 3 December, according to the Agence régionale de santé (ARS) Île-de-France, France’s regional health service, prompting it to shut down its network as a security measure.
It said that no other health facility had been impacted by this cyber attack. The National Authority for Security of Information Systems (ANSSI), the agency in charge of the country’s computer security, is also carrying out an investigation into the incident.
“Cyber criminals know that hitting patient services and business availability is the most effective way to gain a ransom payment,” said Simon Chassar, CRO at Claroty. “The healthcare industry is one of the few sectors where cyberattacks can fatally impact human life, and threat actors know this.
“They want to put decision-makers in a morally impossible situation so that they have no choice but to pay ransoms in order to get their services back up and running. Unfortunately, situations like this are likely to increase as healthcare providers add more cyber-physical systems to their networks.”
André Mignot was forced to transfer some patients to other hospitals and is only accepting a limited number of new patients. In case of an emergency, patients are advised not to go to the site but dial 15 to reach the French Medical Services (SAMU) instead and receive instructions on where to go. ARS said it’s on-site and organising continuity of care and management of patients at a regional level with the SAMU.
The hospital has also enacted emergency measures including a “white plan”, where hospitals can reorganise internal spaces or transfer patients to other services, as well as pushing back the date for operations that are less urgent. It has also partially paused its operating theatre activities.
RELATED RESOURCE
Accelerating healthcare transformation through patient-centred medtech solutions
Seize the digital transformation opportunities to streamline patient care and optimise patient outcomes
ARS Île-de-France has advised other healthcare establishments in the region to be vigilant in case there are more cyber attacks. The agency has also created a crisis unit to allow it to monitor the situation, support its teams, and coordinate care between hospitals.
The attack on André Mignot follows a similar incident from August 2022 when the LockBit ransomware group was thought to have attacked a hospital near Paris and demanded a ransom of $10 million.
The cyber attack was confirmed to have occurred on 21 August by the Center Hospitalier Sud Francilien (CHSF) and was reported to have been forced to turn patients away too.
-
Tomorrow's fraud techniquesITPro Podcast Leaders need to proactive as attackers launch more consistent, sophisticated attacks
-
Met Office hails huge efficiency gains in first year of cloud supercomputing with Microsoft AzureNews In moving to the cloud, the Met Office has bolstered operational resilience and helped to deliver more accurate forecasts
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in lifeNews With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Ransomware gangs are sharing virtual machines to wage cyber attacks on the cheap – but it could be their undoingNews Thousands of attacker servers all had the same autogenerated Windows hostnames, according to Sophos
-
Google issues warning over ShinyHunters-branded vishing campaignsNews Related groups are stealing data through voice phishing and fake credential harvesting websites
-
The FBI has seized the RAMP hacking forum, but will the takedown stick? History tells us otherwiseNews Billing itself as the “only place ransomware allowed", RAMP catered mainly for Russian-speaking cyber criminals
-
Everything we know so far about the Nike data breachNews Hackers behind the WorldLeaks ransomware group claim to have accessed sensitive corporate data
-
There’s a dangerous new ransomware variant on the block – and cyber experts warn it’s flying under the radarNews The new DeadLock ransomware family is taking off in the wild, researchers warn
-
Hacker offering US engineering firm data online after alleged breachNews Data relating to Tampa Electric Company, Duke Energy Florida, and American Electric Power was allegedly stolen
