Cyber Incident Victim: Jewish General Hospital
Date:
Oct 2020
Location:
Canada
Summary
Jewish General Hospital experienced a cyber attack involving a computer virus that disrupted its IT network, impacting operations at the institution and affiliated sister facilities. The incident prompted containment efforts by the health authority, with officials clarifying it was not classified as ransomware due to the absence of any monetary demand from attackers.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 28, 2020, the Jewish General Hospital and affiliated sister institutions in Montreal’s west end experienced a cyber attack targeting their information technology systems. The incident began on Wednesday evening, according to public reports, though the exact time of initial intrusion remains unspecified in available sources. Dr. Lawrence Rosenberg, executive director of the health authority overseeing the hospital, confirmed the attack but explicitly denied it constituted ransomware, noting no monetary demands had been received from threat actors. The hospital characterized the event as involving a computer virus affecting IT infrastructure, though technical specifics regarding the malware’s nature or propagation methods were not disclosed publicly. Immediate response efforts focused on containing the incident across the networked institutions, though the article did not detail specific containment methodologies or tools employed.
The attack impacted multiple healthcare institutions under the same health authority, indicating a broader operational disruption beyond a single facility. No evidence suggested patient data compromise or clinical service interruptions during the initial reporting period. Cybersecurity personnel worked to isolate affected systems, though the scope of compromised infrastructure—such as servers, workstations, or medical devices—was not enumerated in the source material. The absence of a ransom demand distinguished this incident from contemporaneous ransomware campaigns targeting healthcare organizations globally. Containment efforts remained ongoing at the time of reporting, with no public timeline provided for full system restoration or resolution. The health authority did not disclose whether external cybersecurity firms or law enforcement agencies were engaged to support incident response activities.