Still no elective surgeries or outpatient visits at major Barcelona hospital due to cyberattack

Medical professionals at Barcelona's Hospital Clínic, one of the Catalan capital's major public hospitals, are, as of Monday morning, still not carrying out elective surgeries, outpatient visits, or extractions such as blood drawing after suffering a RansomHouse cyberattack on Sunday.

An estimated 150 operations, 2,000 to 3,000 outpatient visits, and 300 to 400 extractions were canceled on Monday alone, and while the hospital continues to provide emergency care to patients who arrive by their own means, ambulances have been rerouted to other medical centers in Barcelona, l'Hospitalet de Llobregat, and Badalona. 

Antoni Castells, the hospital's medical director, explained in a Monday morning press conference alongside Sergi Marcén, the Catalan government's telecommunications and digital transformation secretary, and Tomàs Roy of the Catalan Cybersecurity Agency, that doctors were taking paper notes to care for the over 800 hospitalized patients. 

Although there are now fewer patients, Castells spoke of "laborious" note-taking and said many doctors had had to come in to work on their day off to help. The hospital has also had to "reinforce its administrative staff" to cope with the additional workload. 

In addition to Hospital Clínic, the Casanova, Borrell, and Les Corts primary care centers and IDIBAPS research institute, which also use the hospital's virtual server system, have also been affected, as have the Villarroel, Plató, and Maternitat outpatient sites.

The hospital's website has been down since Sunday at 11:17 am when the cyberattack was first detected. 

A "complex" foreign cyberattack

According to Catalonia's Cybersecurity Agency, which is working alongside the Mossos d'Esquadra police force and Interpol, the cyberattack is "complex" and originated outside of Spain. 

"There will not be any negotiations to pay even a cent," Roy said of the information recovery process, adding that the method the attackers had used was not one of its "classic techniques" but rather that it had "evolved."

Hospital Clínic and the government will issue joint statements around midday and in the evening to provide updates on the situation but for now, officials say it is "impossible" to know how long it will take to restore the hospital's services.

UAB university cyberattack in late 2021

This incident comes around a year and a half after a similar attack on the UAB.

On October 11, 2021, Barcelona's Autonomous University fell victim to a major dark web cyberattack, forcing the university to disconnect internal networks and switch off the campus Internet.

A month later, university officials said they were "not aware of" any data having been leaked, nor were they concerned about confidential data such as bank account details or academic transcripts.

As is the case of Hospital Clínic, UAB affirmed on multiple occasions that it would not give in to the hackers' demands.