Brno University Hospital ransomware attack (2020)

Date 	13 March 2020J Stephens, “Serious Cyber-attack Targets Brno University Hospital”, 13 March 2020, Brno Daily., one day after the Czech government declared a state of emergency due to the COVID-19 crisis.“Measures adopted by the Czech Government against the coronavirus”, 23 June 2020, Vlada.cz.
Suspected actor	Unknown
Target 	Brno University Hospital, the second-largest hospital in the Czech Republic, at the time also providing COVID-19 testing capacities.“Brno’s University Hospital, a testing center for coronavirus, facing cyber attack”, 13 March 2020, Expats.cz.
Target systems 	Microsoft Windows-based systems
Method 	The attackers probably used a spear-phishing technique to gain access to the hospital’s networkJ Horák, “Na nemocnici v Brně zaútočil vyděračský virus, špitál povolal krizového IT manažera”, 20 March 2020, Aktuálně.cz. and then deployed ransomware into the network to encrypt the hospital’s data.S Porter, “Cyberattack on Czech hospital forces tech shutdown during coronavirus outbreak”, 19 March 2020, Healthcare IT News.
Purpose 	The attackers most likely aimed at gaining financial profit.
Result 	The hospital was forced to shut down its entire IT network.C Cimpanu, “Czech hospital hit by cyberattack while in the midst of a COVID-19 outbreak”, 13 March 2020, ZDNet. The hospital personnel was instructed not to switch on any computer. The medics were unable to access patients’ data and had to write and transfer their notes manually. Some data were lost irreversibly. The hospital had to postpone urgent surgical interventions and reroute patients to other nearby hospitals. It took several weeks before the hospital was fully operational again.
Aftermath 	The attack turned into a particularly sensitive issue and raised notable concerns of both experts and the general public, as it hit a large hospital just at the outbreak of the COVID-19 crisis in Europe. To prevent more damage, the Czech National Cyber and Information Security Agency (NÚKIB) issued a set of reactive measures to be implemented by healthcare providers subject to the Cyber Security Act.NÚKIB, “NÚKIB vydal reaktivní opatření pro vybrané subjekty ve zdravotnictví”, 22 March 2020. In April 2020, it also issued a binding statement of WarningNÚKIB, “Warning against a cybersecurity threat in the form of an extensive campaign of cyberattacks on information and communication systems in the Czech Republic”, 16 April 2020. alerting of a high probability of an imminent cyber attack on Czech digital infrastructure, mainly on healthcare providers.L Ponikelska, “Czechs Warn Hackers Are Preparing Cyber Attacks on Hospitals”, 16 April 2020, Bloomberg. The Warning was noted with concern by, inter alia, the United States Secretary of State.U.S. Department of State, “The United States Concerned by Threat of Cyber Attack Against the Czech Republic’s Healthcare Sector”, 17 April 2020. Due to this and a number of similar incidents around the world, the EU and NATO also voiced their concerns.Council of the EU, Declaration by the High Representative Josep Borrell, on behalf of the European Union, on malicious cyber activities exploiting the coronavirus pandemic, 30 April 2020. NATO, Statement by the North Atlantic Council concerning malicious cyber activities, 3 June 2020.
Analysed in 	Scenario 14: Ransomware campaign
Collected by: Adam Botek
Category:Example
Category:2020
Category:Ransomware