Cyber Incident Victim: General Medical Laboratory
Date:
Dec 2020
Location:
Belgium
Summary
A ransomware attack targeted General Medical Laboratory (AML), a major private facility handling COVID-19 testing in Antwerp, disrupting its operations by paralyzing the laboratory's website and halting its daily processing of thousands of tests critical to the pandemic response. The attackers demanded payment to restore access, though initial assessments indicated no confirmed theft of patient data. The incident significantly impacted national testing capacity due to the laboratory's role in managing a substantial portion of the country's COVID-19 diagnostics.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 29, 2020, Alan Hope reported a ransomware attack targeting the General Medical Laboratory (AML), located in Hoboken, Antwerp. The attack disrupted the laboratory’s website, rendering it inoperable and halting operations. AML played a critical role in Belgium’s COVID-19 response, processing approximately 3,000 daily tests, representing 5% of the nation’s total testing capacity at the time. As the largest private laboratory handling COVID-19 testing in the country, the disruption immediately impacted public health operations. Hackers deployed ransomware to compromise AML’s systems, though the exact method of initial access or malware variant was not disclosed in available reports. The laboratory’s inability to function normally following the attack underscored its reliance on digital infrastructure for test processing and reporting. No immediate details were provided regarding the duration of the outage or specific technical systems affected beyond the website.
The attackers demanded a ransom payment in exchange for restoring access to AML’s systems, though the article did not specify the ransom amount or currency. At the time of reporting, authorities and AML officials had not confirmed whether patient data was exfiltrated or compromised during the incident. The Brussels Times article, cited by DataBreaches.net, emphasized the severity of targeting critical medical infrastructure during a pandemic, suggesting potential escalation of criminal charges if perpetrators were identified and prosecuted. The incident highlighted operational vulnerabilities in healthcare entities supporting crisis response efforts. Public disclosures did not include information about law enforcement involvement, recovery timelines, or whether AML paid the ransom.