Hospital in Belgium Forced to Redirect Patients Due to Cyberattack

Last updated June 23, 2021
Written by:
Bill Toulas
Bill Toulas
Cybersecurity Journalist

Center Hospitalier de Wallonie Picarde (CHwapi) in Tournai, Belgium, is currently redirecting all incoming patients to nearby hospitals and medical clinics, as a cyberattack that took place last Sunday has left its systems crippled. More specifically, 80 out of its 300 servers have been infected, possibly by ransomware, but the systems which haven’t been affected by this cannot return to normal operations due to the fear of being locked down too.

The latest announcement on the hospital's website mentions the following:

On the positive side, the hospital clarified that no patient data had been compromised, meaning that the actors haven’t stolen anything. However, we can’t rule out the possibility of this being closer to wishful thinking than a solidly-based statement. We should point out that a team from the Federal Police’s Computer Crime Unit is on-site supporting the hospital center's IT team, so experts are involved in the remediation of the situation.

In the meantime, the staff has returned to using pen and paper, while the patients who had their appointments canceled will be notified by phone or SMS. So far, there have been no urgent cases that were redirected elsewhere and had detrimental effects on the patient’s health, but as long as the situation continues, this remains a dire possibility. Thankfully, the town of Tournai has another two large hospitals that can receive the additional burden, even if the coronavirus pandemic situation is still ongoing and pressing.

The weirdest part of the story is that, according to the investigators, no ransom demands have been made by the hackers. This could be an indication that the hospital was targeted by mistake, which has happened before with grievous consequences. Considering that almost a week has passed since the infection, the actors should have declared their demands until now. Also, we couldn’t find anything relevant, having leaked on the dark web or the various extortion portals of the most prevalent ransomware actors.



For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: