Handa Hospital in Tokushima Prefecture disrupted heavily by ransomware attack

On Sunday 31^st of October 2021, Tsurugi municipal Handa Hospital in Tokushima Prefecture suffered a ransomware attack which disrupted the operations of the hospital and involved electronic records of over 85,000 patients being made inaccessible. Indications of the incident were noticed at 12:30 a.m. when many of hospital’s printers started to print out messages that stated the hospital’s data had been stolen and encrypted, and that if a ransom was not paid the data would be released.

“We can’t see any records, including prescriptions, test results and diagnostic images” Doctor Yasushi Sudo

The hospital took countermeasures at around 3 a.m. and later in the morning, the Tokushima Prefectural Police were informed of the incident. The impact to the hospital include the main and backup server of the hospital being fully encrypted by the ransomware as both were on the same local area network. The hospital had to stop accepting new outpatients while only continuing treatment by appointment only and had to switch to paper and pen until old computers were set up.

The hospital has brought in a specialist firm to restore its data, but there is no estimate time of recovery. No threat group has claimed responsible yet but it is believed that LockBit 2.0 ransomware was the ransomware used in the attack. Also, no ransom has been demanded from the hospital.