Marienhaus-Gruppe

Summary

A cyberattack targeted Marienhaus-Gruppe, causing IT disruptions after hackers were identified during preparatory activities on servers through internal security systems and IT vigilance, halting further progression. The intrusion originated from a malicious link sent externally to an employee, deploying malware that infected certain non-critical systems requiring immediate isolation. While patient, resident, and guest data remained unaffected, operational impacts included restricted remote work capabilities and blocked internet access from facilities, though internal network drives remained accessible. The organization engaged a global cybersecurity leader for support and is conducting system scans and adjustments, requesting patience during restoration efforts while maintaining all facility operations and communication channels.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On December 20, 2023, the Marienhaus-Gruppe, a German healthcare provider operating hospitals and social institutions, experienced significant IT disruptions beginning around 16:00 local time. The organization detected unauthorized actors during preparations for a cyberattack against its servers through internal security systems and IT staff vigilance. Initial investigations revealed the breach originated from a malicious link sent externally to an employee, which delivered malware enabling unauthorized access. The attackers' activities were interrupted before they could progress beyond preparatory stages, with the group successfully preventing further intrusion attempts. Immediate containment measures included disconnecting infected systems from the network, though this action rendered certain non-critical infrastructure temporarily inoperable. External cybersecurity experts from a globally recognized firm were engaged to assist with forensic analysis and remediation.

The incident caused operational constraints including restricted remote work capabilities for staff and disabled internet access across Marienhaus facilities, though internal network drives remained accessible for onsite operations. Organization officials emphasized no patient, resident, or guest data systems were compromised, confirming the security of sensitive information. Recovery efforts focused on comprehensive system scans and infrastructure adjustments to eradicate residual threats, with the IT department acknowledging these procedures would require extended time to complete. All Marienhaus facilities maintained operational continuity using alternative protocols, with communication channels and corporate websites remaining functional throughout the incident. The group committed to providing further public updates as additional verified information became available, while urging employees to tolerate temporary workflow disruptions during restoration activities.

Sources

Sources available to members: 2 sources.