Hospital Marcelino Champagnat

Summary

A cyberattack targeted Grupo Marista, disrupting operations at affiliated hospitals and a university. The attack caused prolonged system outages, forcing staff to rely on manual processes for medical records and medication administration. Despite network instabilities, patient care continued without interruption at the affected healthcare facilities. The incident rendered internal systems inaccessible for multiple days, impacting administrative and clinical workflows. Online platforms displayed maintenance notices during the outage.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On or around March 13, 2022, Grupo Marista—a Brazilian organization operating Hospital Marcelino Champagnat, Hospital Universitário Cajuru, and Pontifícia Universidade Católica do Paraná (PUCPR)—experienced a disruptive cyberattack that crippled its operational systems. The attack forced all three institutions to operate without network or system access for at least three days, with systems remaining offline as of March 16. Employees across the affected entities worked without digital tools, described as operating "às cegas" (blindly), relying entirely on manual processes. Public-facing websites displayed maintenance notifications instead of normal content, indicating sustained infrastructure unavailability. The attack caused significant operational instability, though the group did not disclose technical details about the intrusion vector, attacker identity, or specific compromised systems.

Grupo Marista confirmed in an official statement that patient care continued at both hospitals despite the system outages. Medical teams manually tracked patient records and administered medications without digital support, maintaining critical healthcare services. No patient harm or medication errors were reported as a direct consequence of the attack. The organization emphasized that care standards remained uncompromised through manual workarounds, though the prolonged system instability suggested unresolved remediation efforts. No additional technical containment measures, forensic findings, or recovery timelines were disclosed in the available statement. The incident highlighted operational resilience under duress but left unresolved questions about data security, attack origins, and full restoration of services.

Sources

Sources available to members: 1 source.