Cannes hospital CHC-SV reverted to paper after LockBit ransomware attack
- Organization
- Centre Hospitalier Simone Veil de Cannes (CHC-SV)
- Exploit
- Ransomware
- Industry
- Healthcare
Centre Hospitalier Simone Veil de Cannes, a public hospital on the French Riviera, was hit by a cyberattack on April 16, 2024. Staff disconnected every computer on the network as a containment measure, leaving clinicians without access to medical records, the drug prescription system and radiology.
The hospital postponed non-urgent surgery and consultations for the week and directed affected patients to rebook. Emergency care continued, along with internal medicine, surgery, obstetrics, geriatrics, pediatrics, psychiatry, home hospitalization and rehabilitation, with personnel recording information on paper. Telephone lines stayed in service.
France's national cybersecurity agency ANSSI, the health sector response team Cert Sante, Orange Cyberdefense and the regional hospital group GHT06 supported the investigation. In the days after the attack the hospital said no ransom demand had been received and no data theft had been established at that stage.
That position changed at the end of April, when the LockBit ransomware operation named CHC-SV on its leak site and set a May 1 deadline. The hospital said public health establishments never pay a ransom in the face of this type of attack, and LockBit published the stolen files. The hospital said it would identify exactly what had been exposed only after a detailed examination of the material.