Cyberattack hits 9 servers at Chhatrapati Sambhajinagar Hospital, FIR registered

Chhatrapati Sambhajinagar: A cyberattack has crippled key digital systems at Kamalnayan Bajaj Hospital in Maharashtra, forcing staff to manage several administrative and patient-related processes manually amid a system outage.

The attack, which reportedly involved data encryption and a ransom demand, is now being investigated by police after the hospital’s computer network was compromised.

According to the complaint, the disruption was first detected around 3 am on October 18, when staff found that the Hospital Management Information System (HMIS) had stopped functioning and bills could no longer be generated.

The hospital’s IT team subsequently discovered that the servers were inaccessible and the firewall could not be accessed. Antivirus records reportedly indicated a virus attack affecting all nine servers.

Investigators said a ransom note later appeared on the system. The message, attributed to a group identifying itself as “Crypto24 Group”, claimed that hospital files had been encrypted and sensitive information stolen. It threatened to publish the data on a Tor-based leak site unless the attackers were contacted within a specified period, TOI reported.

The breach has affected multiple hospital functions, including billing, insurance claims, reporting and the processing of benefits under government health schemes. Patients have reportedly faced delays in accessing medicines, completing billing formalities and settling treatment claims.

A hospital executive committee member said services had not been completely halted but were operating at a slower pace. The hospital had informed the relevant authorities, including officials overseeing government healthcare schemes, and activated its disaster management plan to manage the disruption.

The hospital also reportedly informed the Indian Computer Emergency Response Team (CERT-In), the national agency responsible for responding to cybersecurity incidents, before approaching the police with technical details of the breach.

Based on the complaint, Satara area police registered a case under Section 308 of the Bharatiya Nyaya Sanhita and relevant provisions of the Information Technology Act. The investigation is underway to establish the circumstances of the attack and identify those responsible.

The incident has raised concerns over the vulnerability of hospital IT infrastructure, particularly when digital systems support essential patient services and access to treatment benefits.