Cyber Incident Victim: Wertachkliniken
Date:
Aug 2024
Location:
Germany
Summary
A cyberattack disrupted IT systems at Wertachkliniken's Bobingen and Schwabmünchen hospitals, causing widespread operational issues including blocked data access and encrypted virtual servers within the hospital information system. The facilities transitioned to limited analog operations, canceling scheduled surgeries as a precaution while IT teams and external experts worked to restore services. Authorities were notified, and a police report was filed to investigate the incident. Hospital leadership prioritized patient safety and communicated updates to affected parties, apologizing for disruptions and thanking staff and patients for their cooperation during the recovery efforts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the night leading into Sunday, September 1, 2024, Wertachkliniken hospitals in Bobingen and Schwabmünchen experienced widespread IT disruptions affecting their core electronic data processing (EDV) systems. Initial analyses confirmed unauthorized blocking of data access to the primary hospital information system, with virtual servers within this infrastructure suffering encryption. The hospitals immediately notified law enforcement authorities and initiated emergency protocols. While clinical operations continued in both facilities using analog procedures, the IT outage forced significant service limitations. Martin Gösele, Executive Board member of Wertachkliniken, confirmed the cyberattack and stated that all scheduled surgeries at the Bobingen location for Monday, September 2, were preemptively canceled to prioritize patient safety.
The IT department began remediation efforts with support from external cybersecurity experts while coordinating with investigative authorities following the police report. Hospital leadership maintained direct communication with patients, staff, and regulatory agencies regarding service disruptions and operational changes. Gösele emphasized restoring full IT functionality and normal clinical workflows as urgent priorities while reiterating that patient welfare remained the central focus throughout the incident. The organization publicly apologized for inconveniences caused by the attack and expressed gratitude to affected individuals for their understanding during the ongoing recovery efforts. Wertachkliniken committed to providing further updates as restoration work progressed.