Cyber Incident Victim: Hillel Yaffe Medical Center
Date:
Oct 2021
Location:
Israel
Summary
A ransomware attack targeted an Israeli hospital, marking the first such incident against a medical facility in the country. The Hillel Yaffe Medical Center maintained patient care using alternative systems but suspended non-urgent elective procedures following the unexpected attack. Israel’s National Cyber Directorate described the incident as major and worked to mitigate it, while the health ministry issued preventive advisories to other hospitals. The attack occurred amid broader global trends of ransomware targeting healthcare institutions, though patient treatment continued normally except for deferred elective care.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 13, 2021, Hillel Yaffe Medical Center in Israel experienced a ransomware attack, marking the first confirmed ransomware incident targeting a hospital within the country. The hospital activated alternative systems to maintain patient care operations following the attack, which officials described as "totally unexpected." Medical treatment continued under standard protocols with the exception of non-urgent elective procedures, which were temporarily suspended. Israel's National Cyber Directorate (INCD) classified the incident as a "major" attack, with director Yigal Unna publicly acknowledging the severity during a U.S.-hosted ransomware summit while response efforts were ongoing. Unna characterized the operational status as challenging, stating "it does not look very good" during initial containment attempts. The INCD coordinated with the Ministry of Health to issue preventive advisories to other Israeli hospitals following the attack.
The incident represented a significant escalation in healthcare targeting within Israel, though Unna noted similar ransomware attacks against medical facilities had previously occurred in other countries. No patient data breaches or treatment disruptions beyond elective procedures were explicitly reported. Contextual data presented by Unna three months prior indicated approximately 20% of Israeli businesses had experienced cyber attacks, with one-fifth sustaining operational damage from such incidents. The hospital maintained public communications through official statements but did not disclose technical details regarding attack vectors, ransom demands, or specific affected systems. Response efforts focused on maintaining critical care through manual and alternative protocols while containing the ransomware's impact. International attention to the incident coincided with contemporaneous warnings about healthcare-targeted ransomware in the United States and Europe.