LockBit claims attack on Croatia's largest hospital, KBC Zagreb

The University Hospital Centre Zagreb, known as KBC Zagreb and the largest hospital in Croatia, took its IT infrastructure offline in late June 2024 following a cyberattack. Systems were shut down on the night of Wednesday, June 26, and clinical staff reverted to paper records while engineers worked on recovery.

The outage lasted about a day. Emergency services were slowed and some patients were redirected to other hospitals in Zagreb. Radiology was the worst affected department because of its dependence on digital imaging, and the temporary inability to print medical reports caused delays elsewhere. Hospital officials said more than 100 specialists were assigned to restoring the systems, and one administrator described the disruption as sending the hospital back decades to pencil and paper.

Days later the LockBit ransomware operation listed KBC Zagreb on its leak site, claiming it had taken patient and employee information, medical records, organ and donor data, and contracts with outside companies, with a deadline in mid July. The Record reported the listing on July 2, 2024. LockBit's claims have proved unreliable in the past, and an initial assessment reported by Security Affairs indicated that patient medical records had not been exfiltrated.

Croatian police and security services opened an investigation. Health Minister Vili Beros said the government would not negotiate with the attackers, and Interior Minister Davor Bozinovic said he was not aware of any ransom demand.