CSIDB logo
Incident

Thoraxzentrum Bezirk Unterfranken

Incident posture

Attack window
Oct 2024
Location
Germany
Status
Unknown
CIA posture
Available to members
Updated
2025-12-27 00:00

Linked entities

Victim
Thoraxzentrum Bezirk Unterfranken
Threat actors
0 actors
Sources
1 source

Timeline

Occurred
Oct 2024
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

A criminal cyberattack disrupted IT systems at Thoraxzentrum Bezirk Unterfranken, causing limited functionality and forcing the organization to prioritize restoring normal operations. While patient care remains secured, communication channels are severely impacted, with restricted phone availability and non-functional email services; emergency contact numbers have been provided for critical departments. Law enforcement authorities are investigating the incident, though the hospital cannot disclose further procedural details due to the ongoing case. The facility continues to operate as a specialized center for pulmonary and thoracic diseases despite these operational challenges.

Motives

Detailed motive labels are available to members.

1 motive

TTPs

Detailed technique labels are available to members.

2 techniques

Description

On October 1, 2024, Thoraxzentrum Bezirk Unterfranken in Münnerstadt publicly disclosed it was operating under limited IT functionality following a criminal cyberattack. The specialized pulmonary and thoracic surgery center confirmed the incident disrupted normal operations, though patient care remained unaffected. The facility’s IT systems experienced partial outages, rendering email communications inoperable and limiting telephone availability. Internal teams prioritized restoring full operational capacity, working intensively to resolve the disruptions. The attack prompted involvement from law enforcement, with the Public Prosecutor’s Office initiating an active investigation. Due to the ongoing legal process, the center declined to provide additional details regarding the attack’s origin, methods, or potential data compromise. Emergency contact numbers were established for critical patient needs, including separate lines for ambulance services, referring clinics, and specialized weaning inquiries.

The incident impaired routine administrative and communication workflows, forcing staff to rely on alternate channels for coordination. While clinical operations continued uninterrupted, the IT limitations created logistical challenges for patient interactions and external collaborations. The center emphasized its historical role as a regional leader in pulmonary medicine, underscoring its reliance on advanced technology for diagnostics, treatment, and rehabilitation services. No timeline was provided for full system restoration, reflecting the complexity of recovery efforts amid forensic and operational constraints. The disruption highlighted vulnerabilities in healthcare infrastructure despite the facility’s stated commitment to maintaining both technical excellence and patient trust since its founding in 1954.

Sources

Sources available to members: 1 source.

CSIDB