Hillel Yaffe Medical Center ransomware attack

On 13 October 2021, the Hillel Yaffe Medical Center in Hadera, Israel, was hit by DeepBlueMagic ransomware that locked every computer system in the hospital. The attack — one of the most damaging on Israeli healthcare to date — forced a 1,000-bed general hospital to fall back on paper for weeks and took roughly two months to fully resolve.

What happened

DeepBlueMagic, a strain first seen in the wild in August 2021, is notable for abusing legitimate encryption tooling: it leverages a third-party disk-encryption product and Microsoft BitLocker to lock drives, which helps it evade conventional anti-malware detection. The attackers are believed to have gained entry by exploiting a vulnerability in a Pulse Connect Secure VPN appliance.

Once triggered, the ransomware encrypted systems across all levels of the hospital, leaving staff unable to log in to clinical or administrative applications. The hospital reverted to manual, paper-based workflows, postponed non-urgent elective procedures, and rerouted some incoming patients to neighbouring facilities.

Impact

• A peer-reviewed clinical study of the incident found measurable operational disruption: average hospital occupancy fell from about 83% to 64%, and surgical and emergency activity dropped sharply in the first days before gradually recovering.
• Time-critical services — heart catheterisations, births and core outpatient care — were largely sustained, a testament to staff improvisation under degraded conditions.
• Recovery was staged over roughly eight weeks: laboratory systems came back first, followed by radiology, then the electronic medical record, with full restoration including email by around week eight.

Attribution and the ransom question

Israeli Health Ministry cyber officials assessed the attackers as likely China-based with a purely financial motive — distinct from the Iran-linked, ideologically driven campaigns hitting Israel around the same period. Crucially, as a government-owned hospital, Hillel Yaffe was legally prohibited from paying the ransom, forcing it to rebuild rather than buy back access.

Why it matters

The Hillel Yaffe attack is a defining example of ransomware as a patient-safety issue. It showed that even when no data is publicly leaked, the denial of access to clinical systems can degrade care across an entire hospital for weeks. The incident — and the parallel wave of attempted attacks on other Israeli hospitals that same week — pushed Israel's health system to accelerate network segmentation, offline backups and VPN patching, and it remains one of the most rigorously documented studies of a hospital cyberattack's real clinical impact.