Cyber Incident Victim: Chansn Hospital
Date:
Apr 2025
Location:
Taiwan
Summary
Chansn Hospital in Taoyuan experienced a ransomware attack that disrupted medical operations and potentially compromised more than 80,000 patient records. The institution disconnected its networks, conducted system scans, and reported the incident to authorities, with police attributing the attack to suspected international hackers. Online registration systems remained offline during recovery efforts, though phone and in-person services continued, while staff worked to reinstall antivirus software and restore IT infrastructure. The incident impacted critical functions including appointment scheduling, new patient admissions, and prescription services. Health officials confirmed monitoring of the situation, referencing previous cyberattacks targeting other Taiwanese hospitals as precedents.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Chansn Hospital in Taoyuan’s Zhongli District experienced a ransomware attack that disrupted operations and potentially exposed sensitive patient data. The hospital received a ransom email on April 14, 2025, prompting immediate activation of emergency protocols. Following standard procedures, the institution disconnected both internal and external networks to isolate the threat, commissioned a comprehensive systems scan, and formally reported the incident to law enforcement on April 15. Police investigators confirmed the ransom demands originated from international hackers, as indicated by email signatures, and initiated a formal probe under Taiwan’s computer crime legislation. The attack significantly impaired critical medical services, forcing the suspension of online appointment systems, new patient registrations, and digital prescription management. Physical operations continued with staff implementing manual workarounds for patient registration via telephone and in-person visits.
Technical recovery efforts focused on rebuilding compromised infrastructure, including antivirus software reinstallation and network restoration. As of April 21, digital registration systems remained offline while repairs continued, though no definitive evidence of data exfiltration had been confirmed. Hospital administrators acknowledged their obligation to report any verified breach under official ransomware guidelines should forensic analysis reveal patient data exposure. The incident affected approximately 80,000 patient records at the 10,000-bed facility, which specializes in long-term care services. Taiwan’s Ministry of Health and Welfare monitored the situation while referencing prior cyberattacks against Mackay Memorial Hospital and Changhua Christian Hospital as contextual precedents. Police maintained their assessment of overseas actor involvement but disclosed no additional investigative details regarding attribution or ransom demands.