The LockBit ransomware group has allegedly claimed responsibility for an earlier Cannes Hospital cyberattack impacting the Cannes Simone Veil Hospital Center (Centre Hospitalier de Cannes). The Cannes Simone Veil Hospital Center, also known as the Broussailles Hospital, was named after former French health minister Simone Veil. The hospital offers patient facilities such as anesthesia, surgery, ENT, ophthalmology, dentistry, mental health, and senior care. While the hospital was immediate in implementing stringent containment measures, ongoing investigations did not find evidence of data theft or direct ties to any threat actor groups.

Staff Forced to Degrade Services After Cannes Hospital Cyberattack

After the cyberattack, medical professionals were forced to switch to pen, paper, and manual processes to continue to provide essential healthcare services such as emergency care, surgery, obstetrics, and pediatrics to patients. Telephony services continue to work normally. Even weeks after the attack, the site still maintains a notice of the cybersecurity attack. The notice reads that the hospital staff is investigating the cyberattack in conjunction with experts (ANSSI, Cert Santé, Orange CyberDéfense, GHT06). Further, the notice stated that while the investigation remains ongoing, there have not yet been any ransom demands or identification of data theft operations. [caption id="attachment_65802" align="alignnone" width="683"] Source: ch-cannes.fr[/caption] Cybersecurity analyst Dominic Alvieri, on X(Twitter), shared an alleged LockBit claim of responsibility for the earlier incident. [caption id="attachment_65735" align="alignnone" width="1200"] (Source: Dominic Alvieri/ @AlvieriD / x.com)[/caption] If the claims are true, the Cannes Simone Veil Hospital Center would be one of the latest victims in a series of recent cyberattacks claimed by LockBit after the ransomware group's operations were disrupted following joint-effort action from the FBI, NCA the UK, and the Europol.

LockBit Ransomware Group Apologised for Earlier Cyberattack on Children's Hospital

Since healthcare targets remain a sensitive target for cyberattacks, many threat actor groups have made claims or suggested they would avoid such targets in their operations. During the Covid-19 pandemic, the Maze ransomware group announced that they would not target healthcare organizations. Later the group was found to continue targeting healthcare units in its operations. Last year in January 2023, LockBit apologized for an attack on Toronto's Hospital for Sick Children, blamed a partner for the attack, in its data leak site, claiming to have blocked the partner allegedly responsible for the attack, and offered code to restore the affected systems. The cyberattack had significant consequences for the pediatric firm such as delayed lab and imaging results, shut down of phone lines, and the staff payroll system. These incidents highlight that the healthcare system remains vulnerable to cyberattacks and can prove to have unwelcome effects on patient health, staff functioning, and morale. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Cannes Simone Veil Hospital Center (CHC-SV) is grappling with the aftermath of a cyberattack that struck the hospital on April 16. The cyberattack on CHC-SV has thrust the hospital into a state of heightened alert as it navigates the complexities of ensuring uninterrupted patient care while contending with the fallout of compromised digital systems.

The response to the cyberattack has been swift and decisive by CHC-SV. The hospital's crisis unit wasted no time in implementing stringent measures, including a general cyber containment protocol that swiftly severed all computer access while ensuring telephony services remained operational. "All computer access was consequently cut off. Telephony continues to work," reads the official notice on the Cannes Simone Veil Hospital Center website.

Cyberattack on CHC-SV: Ongoing Investigations

Collaboration with expert partners such as ANSSI, Cert Santé, Orange CyberDéfense, and GHT06 has been instrumental in analyzing the cyberattack and formulating an effective response strategy. Despite the absence of ransom demands or identified data theft, investigations remain ongoing. "The cyberattack is currently being analyzed in conjunction with expert partners (ANSSI, Cert Santé, Orange CyberDéfense, GHT06). There have been no ransom demands or data theft identified at this stage. Investigations remain ongoing," informed the hospital. In the wake of the CHC-SV cyberattack, hospital professionals have seamlessly transitioned to so-called degraded procedures, relying on paper-based methods to maintain essential healthcare services. While these procedures may be more time-consuming, they ensure that critical medical needs across various specialties, including emergencies, surgery, obstetrics, and pediatrics, continue to be met with unwavering diligence. "Hospital professionals have been applying so-called degraded procedures since Tuesday morning (using paper kits). These procedures are more time-consuming and examination delivery times are longer. Everything is done to guarantee the continuation of care in complete safety across all fields of activity (emergencies, medicine, surgery, obstetrics, geriatrics, pediatrics, psychiatry, home hospitalization, rehabilitation)," notice reads further.

Regional Collaboration for Patient Care Optimization

The coordination efforts extend beyond the confines of CHC-SV, with the establishment collaborating closely with regional health agencies and partner hospitals to regulate patient flow and optimize utilization of healthcare resources. Despite the disruptions caused by the cyberattack on CHC-SV, emergency services remain active. The solidarity demonstrated by partner institutions, including CHU Nice, CH Grasse, CH Antibes, and private sector collaborators, has been invaluable in navigating this challenging period. However, the impact of the cyberattack has been felt, with approximately a third of non-urgent interventions and consultations disrupted in the initial days following the incident. Efforts are underway to expedite the resumption of services, with the operating program expected to reach 90% capacity in the coming days. Importantly, CHC-SV's proactive approach to cybersecurity, including regular risk assessments and preparedness exercises, has ensured a swift and coordinated response to the cyberattack. Priority is being given to restoring IT systems directly linked to patient care processes, emphasizing the hospital's unwavering commitment to maintaining the highest standards of healthcare delivery. The road to recovery, however, remains fraught with uncertainties, as technical investigations and necessary catch-up efforts are anticipated to prolong the return to normalcy. Drawing from the experiences of other healthcare institutions that have faced similar challenges, CHC-SV is bracing for a protracted recovery process. Furthermore, the recent cyberattack on Change Healthcare in the United States highlights the pervasive nature of cyber threats in the healthcare sector. With disruptions reverberating across the country, the incident underlines the urgent need for enhanced cybersecurity measures to fortify healthcare systems worldwide. In response to the cyberattack on Change Healthcare, UnitedHealth Group has mobilized substantial financial support to mitigate the impact on healthcare providers, highlighting the far-reaching consequences of cyber incidents in the healthcare ecosystem. Against the backdrop of a global healthcare landscape increasingly vulnerable to cyber threats, the incident at CHC-SV serves as a poignant reminder of the critical importance of cybersecurity in safeguarding patient welfare. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.