A hospital in France has been hit with a cyber attack and been forced to move patients out of its facility, the second case of its kind in the country this year.
The attack hit the André Mignot hospital in Versailles on Saturday 3 December, according to the Agence régionale de santé (ARS) Île-de-France, France’s regional health service, prompting it to shut down its network as a security measure.
It said that no other health facility had been impacted by this cyber attack. The National Authority for Security of Information Systems (ANSSI), the agency in charge of the country’s computer security, is also carrying out an investigation into the incident.
“Cyber criminals know that hitting patient services and business availability is the most effective way to gain a ransom payment,” said Simon Chassar, CRO at Claroty. “The healthcare industry is one of the few sectors where cyberattacks can fatally impact human life, and threat actors know this.
“They want to put decision-makers in a morally impossible situation so that they have no choice but to pay ransoms in order to get their services back up and running. Unfortunately, situations like this are likely to increase as healthcare providers add more cyber-physical systems to their networks.”
André Mignot was forced to transfer some patients to other hospitals and is only accepting a limited number of new patients. In case of an emergency, patients are advised not to go to the site but dial 15 to reach the French Medical Services (SAMU) instead and receive instructions on where to go. ARS said it’s on-site and organising continuity of care and management of patients at a regional level with the SAMU.
The hospital has also enacted emergency measures including a “white plan”, where hospitals can reorganise internal spaces or transfer patients to other services, as well as pushing back the date for operations that are less urgent. It has also partially paused its operating theatre activities.
RELATED RESOURCE
Accelerating healthcare transformation through patient-centred medtech solutions
Seize the digital transformation opportunities to streamline patient care and optimise patient outcomes
ARS Île-de-France has advised other healthcare establishments in the region to be vigilant in case there are more cyber attacks. The agency has also created a crisis unit to allow it to monitor the situation, support its teams, and coordinate care between hospitals.
The attack on André Mignot follows a similar incident from August 2022 when the LockBit ransomware group was thought to have attacked a hospital near Paris and demanded a ransom of $10 million.
The cyber attack was confirmed to have occurred on 21 August by the Center Hospitalier Sud Francilien (CHSF) and was reported to have been forced to turn patients away too.
-
Why is big tech rolling back DEI initiatives?In-depth Diverse hiring targets and references to DEI in public documents have fallen markedly over the course of 2025
-
ePrivate 5G and partner ecosystems: The blueprint for intelligent infrastructureIndustry Insights Private 5G networks and collaboration between technology partners underpin the next wave of innovation and enterprise digital transformation
-
Volkswagen confirms security ‘incident’ amid ransomware breach claimsNews Volkswagen has confirmed a security "incident" has occurred, but insists no IT systems have been compromised.
-
The number of ransomware groups rockets as new, smaller players emergeNews The good news is that the number of victims remains steady
-
Teens arrested over nursery chain Kido hacknews The ransom attack caused widespread shock when the hackers published children's personal data
-
NCA confirms arrest after airport cyber disruptionNews Disruption is easing across Europe following the ransomware incident
-
Cyber professionals are losing sleep over late night attacksNews Hackers are biding their time and launching attacks when businesses can’t respond
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
