Cyberattack wreaks havoc on Barcelona hospital

OVIEDO, Spain

A “sophisticated” cyberattack on Barcelona’s Hospital Clinic has locked healthcare staff out of the computer system, grinding many activities to a halt, heads of the hospital and local officials said on Monday.

Authorities are scrambling to recover access to data and “determine the depth” of the ransomware attack, which occurred Sunday morning.

Hospital Clinic is a public university hospital and one of Spain’s biggest medical centers. The cyberattack has affected its three locations and three primary care clinics.

In a press conference, hospital chief Antoni Castells said he does not know when service will be able to return to normal.

On Monday alone, 150 surgeries, up to 3,000 appointments and 400 analyses were canceled.

Some areas of the hospital are still functioning, although many patients are being sent to other Barcelona hospitals. Anything the hospital can still do is being done with pen and paper and sometimes without access to patients’ data.

Tomas Roy, head of the Catalan Agency of Cybersecurity, described the ransomware attack as “sophisticated” and said the hackers have used “new attack techniques.”

The hacker group RansomHouse is said to be behind the attack.

“We won’t pay them a cent,” said Catalan Telecommunications Director Sergi Marcen, adding that the hackers have not asked for payments in exchange for the data yet.

Marcen said Catalan police, alongside Europol and Interpol, are investigating.

“We have evidence that there was a data leak and we are analyzing it right now,” he said.

According to IT company Avertium, RansomHouse is a data-extorsion cybercrime operation that breaches networks and steals targets’ data. It is thought to have hacked a Canadian liquor and gaming authority, semiconductor company AMD, a Swedish rail company, and multinational healthcare organization Keralty.

RansomHouse does not take responsibility for attacks, but instead blames victims for not having good security and asks for payment to return the data. If the organization does not send payment, the group publishes some stolen data online and puts it up for sale on the dark web, according to Avertium.