Hospital, clinic or institute: what still lets you treat patients after a cyberattack?
After a cyberattack, a hospital, a clinic or an institute keeps treating patients if the phone still answers, if degraded mode is written down, and if a copy of the data exists outside the encrypted servers. A patient record that is down does not have to leave the organisation mute. Recent public cases show both outcomes.
Host Technology does not run a university hospital's information system and replaces neither ANSSI nor the health CERT. The reader here is a clinic, an imaging institute, a laboratory or a group practice in PACA and Monaco, with no internal security team. The facts cited are those in the public reports. No impact figure is added.
Cannes, April 2024: contain, and unplug the copies
On 16 April 2024, the Simone Veil hospital in Cannes was hit by ransomware. In its lessons-learned note published on 29 October 2024, the health CERT describes entry the day before through a compromised account, then elevation of that account to Windows domain administrator. The payload was deployed by group policy. A file server and 15% of workstations were encrypted. PACS, the medical images, were also hit through a vendor vulnerability.
The hospital isolated its networks and disconnected its backups. The health CERT says encryption was stopped and that a degraded mode in some departments did not stop patient care. The useful lesson for a clinic is not the tool. It is the order: stop the spread, put copies out of reach, keep receiving patients on a path already written down.
Stell, March 2025: an old audit account
In March 2025, the Stell departmental hospital in Rueil-Malmaison was compromised. The health CERT note published on 14 October 2025 starts from an old administrator account reactivated for an audit, with VPN access and a weak password. The attacker used it to deploy ransomware and encrypt several Windows servers. VPN flows were cut, servers isolated. The directory was rebuilt and line-of-business services restored in stages, with ANSSI and the health CERT.
This scenario is not reserved for a public hospital. A clinic that reopens an account 'for an audit', still an administrator, still on the VPN, rebuilds the same door. The list of administration accounts, suppliers included, is the subject of the 15 September article. Here we see what that door costs when the business is care.
Haute-Comté: the switchboard can stay mute for months
On 19 October 2025, the Haute-Comté intercommunal hospital suffered an attack that stopped the entire hospital information system, in Pontarlier and the group's other sites. The Bourgogne-Franche-Comté regional health agency, in its 30 March 2026 update, writes that application access was still limited to a secured space, that the switchboard had only just been restored, and that workstations were still being reinstalled through the end of April. A return to normal was not expected before early 2027. Reconstruction covers more than 1,000 PCs and about 200 applications, with ANSSI and the health CERT, reachable 24 hours a day.
About five months passed, between the attack of 19 October 2025 and the regional health agency's update of 30 March 2026, before the switchboard answered again. That delay is the one described on that date. It does not say where the hospital stood on 1 November 2026. During those months, reception, families and partner doctors no longer reached a number that answered. A clinic in Cannes or Monaco does not have the same volume. It has the same need: a telephone path that does not live on the same network as the patient record. If everything shares the same link and the same directory, isolating the care system to stop the attack also cuts the phone.
Chaumont, July 2026: detect, disconnect the Internet, keep the phone
On 2 July 2026, Chaumont hospital was attacked. LeMagIT, on 10 July 2026, reports the statements: anomalies were seen, the hospital disconnected from the Internet, care continued and the telephone network stayed up, with the regional health agency, Dijon university hospital and the hospital group. Early detection and a phone that still answers are the two facts worth keeping, without extrapolating the rest of the incident.
Setting Haute-Comté next to Chaumont does not rank the teams. It shows two public outcomes: a switchboard restored only after several months, and a telephone network that still answers on the day of the attack. For an imaging institute or a clinic, the phone, the backup link and the offline copy are prepared beforehand, not on the morning of the cut.
What a clinic or an institute can hold
- Named administration accounts. No audit account left open, no VPN with a weak password.
- A separate network for imaging, the record and administration. A guest or a supplier does not reach the PACS.
- Telephony that still answers if the care system is isolated. Published numbers, reception, the medical on-call.
- A copy disconnected from the production network, with the date of the last restore test. Cannes unplugged its backups to protect them.
- One page of degraded mode: who answers the phone, where today's appointment list is on paper, who calls the health CERT and the software vendor.
- Someone who reads an alert at night, if EDR is in place. The SOC does not treat patients. It shortens the time before isolation.
Host Technology prepares the link, the firewall, telephony, the copy and, if the contract says so, detection. It does not notify patients, it does not restore the record in place of the vendor, and it does not replace the health CERT. The national CaRE programme, cited by the regional health agency for healthcare organisations, reminds them that continuity and recovery are worked on before the crisis. A private clinic does not wait for a university-hospital security lead to write these six lines.
Sources
Health CERT, lessons learned on 29 October 2024 on Cannes hospital (attack of 16 April 2024): https://cyberveille.esante.gouv.fr/retours-d-experience/attaque-par-rancongiciel-du-centre-hospitalier-de-cannes-2024-10-29. Health CERT, note of 14 October 2025 on Stell hospital (compromise of March 2025): https://cyberveille.esante.gouv.fr/retours-d-experience/compromission-du-si-et-ransomware-au-chd-stell-2025-10-14. Bourgogne-Franche-Comté regional health agency, update of 30 March 2026 on Haute-Comté hospital (attack of 19 October 2025): https://www.bourgogne-franche-comte.ars.sante.fr/index.php/point-de-situation-au-centre-hospitalier-de-haute-comte-cybersecurite-une-reponse-collective. LeMagIT, 10 July 2026, on Chaumont hospital (attack of 2 July 2026): https://www.lemagit.fr/actualites/366645798/Cyberhebdo-du-10-juillet-2026-le-centre-hospitalier-de-Chaumont-echappe-au-pire. ANSSI IT hygiene guide, administration accounts and segmentation: https://cyber.gouv.fr/publications/guide-dhygiene-informatique.
FAQ
Is a private clinic targeted like a public hospital?
The public attacks cited hit hospitals. The door described, a compromised account or an old admin account, also exists in a clinic, an imaging institute or a laboratory. Size does not close that door.
Should we pay to get the records back?
This text does not discuss the ransom. Recovery in the public reports goes through isolation, copies that can still be read, and rebuilding. The health CERT and ANSSI provide that support for organisations that call them.
Does a working phone mean care continues?
No. It means you can be reached. Degraded mode, the day's patient list and the record's vendor still have to be planned. The regional health agency's update of 30 March 2026 on Haute-Comté describes a switchboard restored only by that date. It does not describe the hospital on 1 November.
Does Host replace the health CERT?
No. Host holds the infrastructure in the contract: network, telephony, copy, detection. The health CERT and ANSSI remain the crisis contacts for healthcare organisations.
Where do we start on the Riviera?
With administration accounts, the telephone path, and the date of the last copy test. Host does this from Tourrettes-sur-Loup, on site from Nice to Monaco.