Skip to content
←Back to glossaryCyber

Sud Francilien hospital (CHSF) ransomware attack (2022)

Ransomware that crippled the roughly 1,000-bed hospital in Corbeil-Essonnes from August 21, 2022; the hospital refused the 10-million-dollar ransom, and LockBit published part of the stolen data.

Definition

The attack on the Sud Francilien hospital center (CHSF) is the ransomware case that crippled, from August 21, 2022, this hospital of roughly 1,000 beds in Corbeil-Essonnes, south of Paris. On a Sunday, the virtual servers were encrypted, taking imaging and clinical software down with them. The emergency department went on diversion, patients were transferred, and staff went back to paper for weeks. The initial demand was 10 million dollars. The hospital refused, in line with French government policy. LockBit claimed the attack on its site in September, then at the end of September published a first batch of around ten gigabytes, including social security numbers and health data. The ransom then dropped to about one million dollars, this time to withhold the rest. According to the hospital, the core patient record and human resources databases were not reached; the attack reportedly hit about 10% of storage. The case shaped public policy: it sped up funding for hospital security, followed by the CaRE program launched in late 2023. For the underwriter, CHSF illustrates double extortion without payment. The loss splits in two: business restoration on one side, notification to the CNIL and to affected individuals on the other, each on its own timeline. It also shows that a public hospital absorbs most of the cost on its own budget and the regional health agency's, with insurance playing only at the margin.

Its 7 cross-references, woven across the glossary's 18 categories
Sud Francilien hospital (CHSF) ransomware attack (2022): Cyber glossary illustration, AlgoPolis
Example

At the end of September 2022, after the refusal to pay, LockBit posted files on CHSF patients and staff. The hospital was then handling two losses moving at different speeds: restoring operations, underway for a month, and informing the people whose data was circulating, which was only starting. For a cyber insurer, these are two coverage sections, two vendor teams and, depending on the wording, two retentions.

Read next
CyberRansomware attacks on hospitalsAn attack that encrypts the systems of a hospital, laboratory or healthcare vendor and threatens to publish patient data, using the disruption of care as leverage to extract a ransom.Read the entry →CyberLockBitCybercriminal group that operated the most prolific ransomware-as-a-service network between 2019 and 2024, before its partial dismantlement by Operation Cronos.Read the entry →CyberDouble extortionA ransomware technique that encrypts data and threatens to publish it, to increase pressure on the victim.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Also known as

CHSF ransomware, Corbeil-Essonnes hospital attack, Sud Francilien hospital cyberattack, LockBit French hospital attack

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.