Cyber Incident Victim: Centre Hospitalier Général d'Oloron
Date:
Mar 2021
Location:
France
Summary
Centre Hospitalier Général d’Oloron experienced a ransomware attack that encrypted all patient files across workstations and paralyzed its entire computer system, rendering both internal and external networks inoperable. The attackers demanded a $50,000 Bitcoin ransom, with the incident reflecting similar patterns observed in prior attacks on other French healthcare facilities where critical systems were compromised.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 8, 2021, Centre Hospitalier Général d'Oloron in France experienced a ransomware attack that began in the early afternoon. The attack encrypted all patient files across every workstation, rendering the hospital's computer systems inoperable. A ransom note demanded payment of $50,000 in Bitcoin to restore access, paralyzing both internal and external networks. This disruption halted all digital operations, including clinical applications and administrative systems. The malware's behavior matched previous attacks on French hospitals in Dax and Villefranche-sur-Saône during February 2021, though the specific ransomware variant wasn't identified in initial reports. Hospital staff discovered the intrusion when systems became inaccessible and the ransom message appeared. No patient data exfiltration was mentioned in available reports, with the primary impact being system encryption and operational paralysis.
The attack forced the hospital to operate without digital systems, affecting clinical workflows and administrative processes. France Bleu reported the complete network outage persisted following the encryption event, though the hospital's emergency response measures weren't detailed. Authorities drew parallels to the earlier attacks on Dax and Villefranche-sur-Saône hospitals, which had experienced similar encryption-based disruptions. The Bitcoin ransom demand indicated financially motivated cybercrime, consistent with prevalent ransomware tactics during that period. No information was provided about whether the ransom was paid, system recovery timelines, or law enforcement involvement in the investigation. The incident highlighted vulnerabilities in regional healthcare infrastructure, marking at least the third such attack on French hospitals within six weeks.