Gesundheits- und Pflegeeinrichtungen Lindenbrunn e. V.

Summary

A healthcare organization operating multiple medical and care facilities experienced a cyberattack, prompting immediate containment measures including network disconnection and communication line termination. The incident caused significant operational disruptions, with telephone, fax, email, and data exchange systems remaining offline for an extended period. While patient and resident care continued unaffected, investigators with external cybersecurity experts are assessing potential data compromise and system integrity. Restoration timelines remain uncertain as forensic examinations of servers and databases continue, with full functionality not expected before the following week. Limited contact remains possible through a designated email address and central phone number during the outage.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 9, 2024, Gesundheits- und Pflegeeinrichtungen Lindenbrunn e.V. (GPL) discovered it had been targeted in a cyberattack affecting its network of healthcare facilities, including Krankenhaus Lindenbrunn in Coppenbrügge, Haus Viktoria Luise in Rehburg-Loccum, Haus Kurt Partzsch in Bückeburg, Scharnhorst Residenz in Hameln, and a nursing facility in Bad Nenndorf. The breach was identified in the early evening, prompting immediate activation of emergency protocols. All IT systems were disconnected from the network as a containment measure, with external connections severed—including telephone lines—resulting in significantly limited operational communications. Patient and resident care remained uninterrupted despite these disruptions. GPL established alternative contact methods through a single email address ([email protected]) and a designated phone line (05156 782-0) while primary communication channels remained offline.

Forensic analysis commenced immediately following system isolation, with GPL's internal IT team collaborating with external cybersecurity experts to examine servers and databases. No timeline was established for restoring critical systems, applications, or data access points, with officials anticipating continued disruptions to standard communication methods—including phone, fax, email, and data exchange—through at least the seventh calendar week of 2024. The investigation had not yet determined whether patient or resident data was compromised. System restoration remained contingent upon completion of security reviews and formal authorization by forensic teams. Operational continuity measures remained in effect while technical recovery efforts continued without projected completion dates.

Sources

Sources available to members: 1 source.