Cyber Incident Victim: Doctor's Hospital
Date:
Apr 2025
Location:
Cayman Islands
Summary
Hackersinfiltrated Doctor's Hospital's network and demanded a ransom, disabling systems for insurance billing, patient charging, and clinical operations across inpatient, outpatient, maternity, radiology, laboratory, pharmacy, and administrative areas, with the ENT Clinic at The Strand and Integra Healthcare also impacted due to shared connectivity. Staff resorted to handwritten notes and manual transfer of information, causing significant delays while emergency care continued, and the facility has not issued an official statement as cybersecurity teams work to determine data exposure and restore services.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On Sunday afternoon, hackers breached Doctor’s Hospital’s network and began demanding a ransom. By the morning of April 27, 2025, the hospital’s front office was unable to process insurance claims or properly charge patients, effectively rendering all services free until further notice. Sources confirmed that the breach had occurred the previous day and that the attackers were still engaged in extortion efforts. The hospital had not issued an official public statement about the incident at that time. The outage paralyzed operations across inpatient services, outpatient clinics, the general ward, maternity ward, radiology, laboratory, pharmacy, and administrative offices. Staff were forced to handwrite notes, record laboratory results manually, and physically deliver information between departments. The ENT Clinic at The Strand and Integra Healthcare, which share the same system, also experienced the disruption and operated manually while IT teams worked to contain the breach. A patient visiting the pharmacy for a prescription refill was told by staff that the system had been hacked and was down since yesterday.
Cybersecurity experts were urgently assessing the extent of the breach, determining whether sensitive patient information had been compromised, and attempting to restore operations. It remained unclear whether the hospital was in negotiations with the attackers or planning to pay the ransom. The disruption caused significant stress to staff and impeded patient care, leading the hospital to advise patients with appointments to expect significant delays while urging those with non‑urgent needs to defer visits. Emergency cases continued to be accepted, and the incident highlighted broader cybersecurity vulnerabilities in Cayman’s private healthcare sector.