Brno University Hospital ransomware attack

On 13 March 2020, at the height of the early COVID-19 outbreak, a ransomware attack struck Brno University Hospital (Fakultní nemocnice Brno) — one of the Czech Republic's largest hospitals and home to one of the country's biggest coronavirus testing laboratories. The hospital was forced to shut down its entire IT network, an extraordinary disruption at the worst possible moment.

What happened

The infection reportedly began around 2 a.m. and was discovered at roughly 5 a.m. on Friday, 13 March 2020. Faced with spreading encryption, hospital staff made the decision to disconnect all computer networks to contain the malware. This precautionary shutdown — rather than the ransomware alone — drove much of the operational impact.

The Czech National Cyber and Information Security Agency (NÚKIB) confirmed the incident and worked with law enforcement and hospital staff to restore services. NÚKIB had, only days earlier, issued a warning about a rising wave of cyberattacks against Czech healthcare institutions during the pandemic.

Impact

• The hospital took its entire IT system offline, severing access to key clinical systems.
• Planned surgeries were postponed and acute patients were transferred to other facilities.
• Staff were unable to transfer data from critical clinical systems into the hospital's databases, slowing care.
• The disruption hit a facility running major COVID-19 testing operations just as the Czech Republic confronted the pandemic's first wave.

Context and response

The Brno attack arrived amid a broader pattern of ransomware targeting Czech hospitals — coming only months after the Benešov hospital was paralysed by Ryuk ransomware in December 2019. It crystallised fears that healthcare cyberattacks during a pandemic could cost lives, prompting international commentary on the urgent need for cyber norms protecting medical facilities.

The hospital recovered over the subsequent days and weeks, and NÚKIB escalated its warnings to the wider Czech health sector to harden defences against further intrusions.

Why it matters

Brno became an internationally cited example — featured in the CCDCOE Cyber Law Toolkit — of how ransomware against critical healthcare infrastructure during a public-health emergency can endanger patient safety. It underscored that the gravest consequence of a hospital ransomware attack is not data loss but the interruption of care, and it accelerated national and EU debate over protecting medical facilities from cyberattack, even in the absence of a confirmed ransom payment.