Cyber Incident Victim: Bikur Rofeh
Date:
Mar 2025
Location:
Israel
Summary
Bikur Rofeh reported a suspected cyber incident affecting its computer systems, prompting an investigation by its security teams and the Health Ministry to determine whether any data breach occurred and its possible scope. The clinic said it detected signs of an attack by Iranian actors early this week, immediately isolated its network, and has found no evidence of confidential information leakage. While its agreement with the IDF for urgent medical services remains unaffected and does not involve access to classified military data, authorities continue to monitor the situation for any further impact.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
OnMarch 1, 2025, the Israeli Health Ministry announced initial reports of a suspected cyber incident affecting the computer systems of Bikur Rofeh, the country's leading private primary emergency medical services clinic. The ministry stated that Bikur Rofeh's cybersecurity teams are investigating the incident and assessing whether any data breach has occurred and its potential scope. According to the ministry, it is too early to determine the full extent of the incident, but all relevant authorities are preparing for any scenario. Bikur Rofeh reported that earlier this week it identified an indication of a cyber incident carried out by Iranian attackers, and the discovery was made at an early stage. Upon detection, the company immediately took containment measures, including proactively disconnecting its organizational network, to reduce risks and maintain information security. So far, Bikur Rofeh has found no indication of a leak of confidential or material information resulting from the incident. Maariv reported that the data agreement between Bikur Rofeh and the Israel Defense Forces remains unaffected by the cyber incident. The Bikur Rofeh medical network operates under this agreement to provide urgent medical services to soldiers, although it does not have access to classified military data.
In addition to serving soldiers, the network provides medical services to public bodies and health insurance funds, with soldiers visiting its clinics for treatment and sick leave approval. According to Ynet, the cyber attack occurred in recent days and is suspected to have been perpetrated by Iranian actors. The Health Ministry and other relevant authorities continue to monitor the situation and prepare for any potential developments as the investigation proceeds. Bikur Rofeh maintains that, at this stage, there is no evidence of compromised confidential or material information.