Ramsay group

Summary

A healthcare provider within the Ramsay group experienced a ransomware attack targeting a clinic near Toulouse, prompting immediate network disconnections and activation of contingency protocols. Operational disruptions slowed patient care as systems were temporarily disabled, forcing staff to rely on paper-based processes for prescriptions and treatment tracking. The attackers demanded a significant ransom to restore server access, though no evidence of data exfiltration or compromise of patient information was identified. This incident follows a prior cyberattack against the same organization, highlighting recurring security challenges. Normal operations remained partially affected with no confirmed timeline for full restoration.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 26, 2023, the Ramsay Group reported an external cyber intrusion attempt affecting its Clinique de l’Union facility near Toulouse, France. The incident disrupted operations at this specific location within the Ramsay Santé Toulouse hub, with no initial evidence of impact on other regional facilities. The clinic activated its degraded mode security plan by Wednesday afternoon, January 25, preceding the public disclosure. This involved disconnecting all external network connections and voluntarily shutting down certain servers to contain the incident. Patient care experienced delays due to these measures, though clinical operations continued under modified protocols. Staff reverted to paper-based systems for medical recordkeeping and prescription management to maintain service continuity.

Local media attributed the attack to ransomware, with perpetrators allegedly demanding substantial payment for server access restoration. Ramsay's Pôle Toulouse director Fabrice Derbias confirmed the organization proactively severed its own network connections rather than waiting for attacker actions. No data exfiltration or patient information compromise had been detected at the time of reporting. The clinic maintained normal care delivery despite operational complications from manual processes. Ramsay's communications did not specify recovery timelines or permanent consequences beyond the immediate service degradation. This incident followed a previous 2019 cyberattack against the healthcare group, though the article provides no details regarding potential connections between the two events.

Sources

Sources available to members: 1 source.