The Cannes Simone Veil hospital center confirmed on May 2 that the data published on the Dark Web on the evening of May 1 belonged to it. This is 61 GB of data. The hospital announced on April 30 that the cyber attack it suffered since April 16 had been claimed by the Lockbit 3.0 thug group. The establishment declared that it had then become aware of a ransom demand from the hacker group Lockbit3.0.
The hospital had no intention of paying the ransom. The claim was transmitted to the Gendarmerie and the National Information Systems Security Agency (ANSSI). “ Public health establishments never pay ransom in the face of this type of attack » emphasized the hospital.
Future harm to patients and partners
The management of the hospital center condemns the publication of the data and regrets the damage that will be caused to some of its patients, professionals and partners. The hospital continues to qualify the data that was exfiltrated from its systems.
The hospital announces that it will provide detailed and personalized feedback in the coming days to the people and institutions concerned. The management of the hospital center is supported by CERT-Santé and various partners specializing in cyber security. She has filed a complaint and is contributing to the ongoing investigation. An alert was also sent to the CNIL and ANSSI.
Resumption of activity in an almost ordinary way
The hospital indicates that it has resumed the course of its hospital activity in an almost ordinary manner. Management informs that the restoration of normal operation of its information system is occurring at a pace consistent with the action plan defined at the start of the crisis.
On April 17, the hospital declared that a cyber attack had been in progress since the morning of Tuesday, April 16. A crisis unit had decided on a general cyber lockdown in all sectors. All computer access was cut off as a result. Telephony continued to work.
The cyber attack was analyzed with ANSSI, Cert Santé, Orange CyberDéfense and GHT06 (Groupement Hospitalier de Territoire des Alpes Maritimes). On April 17, the hospital indicated that there had been no ransom demands or data theft identified at this stage.
Relying on paper to continue operating
Since Tuesday morning, hospital professionals had been applying degraded procedures using paper. These procedures take more time and exam turnaround times are extended.
The hospital declared that it was acting to guarantee the continuation of care in all fields of activity, that is to say emergencies, medicine, surgery, obstetrics, geriatrics, pediatrics, psychiatry, home hospitalization and rehabilitation.
The establishment relied on the Regional Health Agency and the Alpes Maritimes Territory Hospital Group to regulate patients in the territory according to medical profiles and hospitalization capacities within the Cannes hospital center Simone Veil and from other establishments. The organization of care was monitored at departmental level. Emergency activity remained active in conjunction with Samu.
The Cannes hospital relies on the local ecosystem
The establishment’s partners within the GHT are the University Hospital of Nice, CH of Grasse, CH of Antibes.
During the day of Tuesday April 16 and Wednesday April 17, approximately a third of the non-urgent operating room schedules were canceled by medical decision. Several non-urgent consultations had been canceled. Certain consultations requiring little in terms of IT and concerning known chronic patients could be maintained.
The CHC-SV then declared that it had never been the victim of a cyber attack of this type. IT restart priority was then given to software directly linked to the patient care process for the computerized patient file and the rendering of examinations. Exercises had been held in recent months at the hospital and had enabled strong responsiveness to the event, according to management.
