UPDATE: Hackers demand €4.2 million from Barcelona’s Hospital Clinic not to release stolen data

Hackers who carried out a ransomware cyberattack on Barcelona’s Hospital Clinic have demanded €4.2 million in exchange for not disclosing the stolen data.

Saturday, March 11 at 3:55am

A group of hackers called RansomHouse claimed responsibility for the ransomware attack last Sunday 5 on Barcelona’s Hospital Clinic. They have since demanded payment of €4.2m ($4.5m) from the government to prevent them from publishing online or reselling the data that it stole.

Sergi Marcen, the Secretary of Telecommunications and Digital Transformation of the Generalitat, assured: “We will not pay or negotiate with these cybercriminals”.

Among the data that the criminals could publish are research and trials on cancer and autoimmune diseases, fields in which the Clinic is a leader. This Friday 10, five days after the cyberattack, the hospital was still working without internet with its professionals working manually, on paper, like 20 years ago, as reported by elperiodico.com.

Monday, March 6 at 8:27pm

According to two experts today, Monday, March 6, the ransomware cyberattack that hit Barcelona’s Hospital Clinic yesterday, Sunday 5, originated from outside Spain. This was announced in a press conference by Sergi Marcen, the Secretary for Telecommunications and Digital Transformation of the medical facility.

His claim was backed up by both Dr Antoni Castells, the hospital’s medical director, and Tomas Roy, the general director of the Catalan Cybersecurity Agency. The incident: “is not an attack that has come from the Spanish State, it comes from outside Spain”, they stated jointly.

The three men described the attack as ‘complex and transversal’ and explained that it came from a cybercrime company called Ransom House. “Normally, Ransom House carries out these types of attacks in exchange for money, but so far they have not been in contact”, said Marcen.

These attacks normally consist of disabling a computer system in exchange for a payment to recover the information, but Marcen assured that “there will be no negotiation to pay”.

As a result of the attack, about 150 elective surgeries, 500 extractions and some 300 external consultations are still unscheduled. Urgent cases such as heart attacks or strokes will be redirected to other medical facilities. “We cannot access the information of the patients”, they explained.

Sunday’s attack affected communication between hospital departments and for now, it is not possible to access histories and other patient data, although Castells has assured that this information “is not affected”.

It is not yet known to what extent the cyberattack could have affected the data, although they assured that “it has been a complex attack, we have evidence that data has been leaked, and we are in the process of analyzing it”

Castells warned that they do not know exactly when they will be able to recover full activity. “The contingency plan allows us to work many days like this, but we hope it won’t be necessary”. As of midday on Sunday, the centre launched the contingency plan, because it was not possible to access the necessary information or add new ones.

As a result, they were able to deal with emergencies in the normal way, but working with a pen and paper and at a much slower pace. As for the 800 hospitalized patients, the director stated that they have been able to receive proper care.

The cyberattack affected the hospital’s three sites – Villarroel, Plato, and Maternidad – as well as the three primary care centres managed with ICS: Casanova, Borell, and Las Corts.

Castells has also requested patients who had an outpatient visit to please not attend. “Let no one suffer, if assistance is necessary, they will have it until the Clinic returns to 100% activity”, he stressed.