Centre Hospitalier d'Armentières

Summary

The Centre Hospitalier d'Armentières experienced a cyberattack involving data encryption, with hackers demanding a ransom for data restoration. The incident disrupted hospital operations, forcing the emergency department to close temporarily and requiring patient diversions to other facilities; unauthorized messages printed across connected devices confirmed the system compromise.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 11, 2024, Centre Hospitalier d'Armentières in northern France experienced a cyberattack discovered around 2:00 AM during the overnight shift from Saturday to Sunday. The intrusion was initially detected when hospital printers autonomously produced a message declaring the institution’s data had been encrypted, accompanied by instructions to contact the attackers for restoration. Hospital administration, including Deputy Director Samy Bayod, confirmed the incident to France Bleu Nord, characterizing it as the facility’s first ransomware compromise. The attackers explicitly demanded a ransom payment in exchange for decrypting the hospital’s data, though the specific amount and cryptocurrency details were not disclosed in available reports. Immediate operational disruptions necessitated the closure of the emergency department for at least 24 hours, forcing patient diversions to neighboring hospitals. No patient data exfiltration or clinical system tampering was mentioned, suggesting the primary impact centered on data encryption and service availability.

Hospital administrators activated incident response protocols, including internal IT containment measures and external coordination with unspecified law enforcement and regulatory agencies. The attack caused measurable service degradation beyond emergency care, though outpatient, surgical, and inpatient operations were not explicitly detailed as affected. No patient harm or procedural cancellations were cited in the immediate aftermath. The hospital’s public communications via traditional media did not reference restoration timelines or data recovery methods, focusing instead on service adjustments and attacker communications. France Bleu Nord’s reporting emphasized the novelty of the incident for Armentières while contextualizing it within broader regional healthcare cyber threats. Technical specifics regarding attack vectors, malware variants, or infrastructure compromise remained undisclosed in available source material as of the reporting date.

Sources

Sources available to members: 2 sources.