Israeli hospital hit by ransomware attack during Yom Kippur
Learn More
Shamir Medical Center (Assaf Harofeh), Israel's fourth-largest government hospital, was hit by a ransomware attack during Yom Kippur that potentially exposed sensitive patient data. Shamir Medical Center runs at about ninety percent patient capacity year-round and serves over one million residents in Israel's central region.
The Ministry of Health, the hospital, and Israel's National Cyber Directorate jointly announced on October 2, 2025, that a serious cyberattack attempt was identified and blocked during the Jewish holiday. The Qilin ransomware gang claimed responsibility for the attack, asserting they successfully infiltrated the hospital's systems and stole approximately eight terabytes of sensitive and confidential data. They are demanding a ransom of seven hundred thousand dollars.
The attack impacted a medical records system used by hospitals across Israel and administrative computer systems. The hospital's core operations apparently were not affected. Israeli authorities from the National Cyber Directorate and the Ministry of Health stated that the attack was neutralized in its early stages, but they acknowledged it's possible that information was stolen.
Qilin's dark web posting claims the stolen data includes:
- Private health records of an unknown number of patients
- Internal communications and critical operational information
- Patient medical records and treatment data
- Administrative and employee information
- Sensitive institutional data
Qilin provided only four file samples as proof of the alleged breach, a small fraction compared to their claim of eight terabytes of exfiltrated data.
The number of affected individuals is not disclosed. Given that Shamir Medical Center serves over one million residents annually the potential scope of the breach could be substantial.
Update - as of 3rd of October 2025, per the joint statement from the Israeli Health Ministry and the National Cyber Directorate, the cyberattack breached exposed hospital emails dated September 25. Some of the compromised emails included confidential patient data.
