Loading story…
Belgian hospital AZ Monica (campuses in Antwerp and Deurne) shut down all servers after a cyberattack discovered around 06:30 local time, forcing the organization to cancel scheduled care and operate emergency services at reduced capacity. With staff unable to access electronic patient records, the hospital postponed non-urgent consultations and procedures, shifted to paper-based registration, and transferred seven critical-care patients to other hospitals as a precaution; reporting also indicates ~70 planned operations were cancelled and ~70 patients were sent home.
Authorities were notified and a criminal investigation is underway, with the public prosecutor involved and Belgium’s federal police cybercrime unit reported on site. Public reporting has not yet confirmed whether systems were encrypted or whether any ransom/extortion demand was made. Separately, Central Maine Healthcare in the U.S. reported a prior-year breach affecting 145,381 individuals after attackers maintained access for over two months, but that incident is unrelated to the AZ Monica disruption.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
By January 14, 2026, reporting indicated the incident was being described as ransomware-related and that the disruption extended beyond surgeries to examinations and treatments such as radiology, medical imaging, and chemotherapy. Hospital leadership said the server shutdown was intended to help protect patient data during the attack.
By the hospital's Tuesday update on January 13, 2026, AZ Monica said ambulances were not transporting patients to its facilities and urged people to seek urgent care through general practitioners or other emergency departments. The diversion increased pressure on nearby hospitals while AZ Monica's emergency department remained only partially operational.
After the attack was discovered, AZ Monica notified police and prosecutors, and the Antwerp public prosecutor opened an investigation. The federal police cybercrime unit responded on site to examine the incident.
The January 13 outage forced AZ Monica to postpone non-urgent consultations, cancel about 70 planned operations, and continue registration and care through slower manual processes. Emergency services operated at reduced capacity, MUG and PIT services were temporarily unavailable, and seven critical-care patients were transferred to other hospitals with Red Cross assistance.
On January 13, 2026, staff at AZ Monica hospital detected a serious IT disruption around 6:30 a.m. affecting its Antwerp and Deurne campuses. The hospital proactively disconnected all servers as a safety measure, cutting off access to electronic systems and medical records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetherecord.media
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcedatabreaches.net
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
McLaren Health Care confirmed it was hit by a ransomware attack that disrupted clinical and business operations across its Michigan network, forcing the organization to rely on downtime procedures and warning that recovery would extend into September. Follow-up reporting said McLaren was still restoring systems weeks later and had not yet determined whether patient or employee data had been accessed or stolen, leaving the scope of any data compromise unclear as the health system worked to bring affected services back online. Ascension, one of the largest U.S. health systems, also suffered a major cyberattack that caused widespread outages, diverted ambulances, and disrupted electronic health records, phone systems, and other care operations; reporting at the time linked the incident to suspected **Black Basta** ransomware activity. Later disclosures said the attack resulted in a data breach affecting **5.6 million people**, exposing personal, insurance, medical, and payment-related information and underscoring how ransomware incidents in healthcare can escalate from operational disruption to large-scale compromise of sensitive patient data.
Jul 12, 2026Minidoka Memorial Hospital in Rupert, Idaho, said a cyber incident on Easter morning temporarily affected internal systems, limited imaging services, and forced some emergency patient transfers, though the hospital and its clinics continued treating patients safely. Separately, medical technology company **Stryker** disclosed a March cyberattack that disrupted ordering, manufacturing, and shipping across parts of its business; Reuters and other public reporting said some patient-specific procedures were rescheduled because personalized inventory could not be delivered on time, even as Stryker said patient-related services and connected medical products were not directly affected. Threat actors quickly tried to exploit both incidents for leverage. A newly emerged ransomware group, **Blackwater**, added Minidoka to its leak site and claimed it stole about **577 GB** of data, but provided no proof and did not clarify whether systems were encrypted. In the Stryker case, public reporting tied the attack to the Iran-linked **Handala** persona, while U.S. authorities seized four domains allegedly used by Iran's Ministry of Intelligence and Security to host stolen data, issue threats, and support Handala operations; prosecutors said attackers abused Microsoft Intune's native wipe capability on more than **200,000** employee devices, highlighting how attacks on healthcare providers and suppliers can ripple into hospital operations and patient care.
Jun 29, 2026
Multiple healthcare-sector cyber incidents were reported, including ongoing fallout from a major U.S. provider ransomware event. **Kettering Health** continues to face escalating legal exposure from a 2025 ransomware attack attributed to **Interlock**, which allegedly stole **941 GB** of data and encrypted systems; the disruption forced shutdown of roughly **600 applications**, a temporary shift to paper workflows, and delays to care while systems (including *Epic* EHR) were restored. Dozens of patient lawsuits have been filed and consolidated in Ohio, with claims focused not only on data theft but also alleged **delayed or denied medical care** during the outage. Separately, healthcare vendor **Insightin Health** disclosed a 2025 security incident involving its use of the *GoAnywhere* managed file transfer tool, reporting that an unauthorized party accessed GoAnywhere by exploiting an **“unknown design flaw”** and potentially accessed files on a subset of servers between **Sept 17–23, 2025**; impacted data may have included names, provider names, insurance information, and member IDs (no SSNs or financial data reported). In Europe, the Independent Public Regional Hospital in **Szczecin, Poland** reported a March 2026 cyberattack that **encrypted parts of hospital data**, disrupted digital operations, and forced a temporary return to paper-based processes, while the hospital stated urgent care continued despite slower administration.
Jul 12, 2026