Hillel Yaffe Medical Center DeepBlueMagic ransomware (Israel, 2021)

On 13 October 2021, Hillel Yaffe Medical Center in Hadera became the first Israeli hospital known to suffer a successful ransomware attack. The malware was identified as DeepBlueMagic — a relatively new family first seen in August 2021. Israeli officials publicly attributed the operation to a Chinese criminal group acting on financial motives.

What happened

The attack hit early on 13 October 2021. DeepBlueMagic's first action on each compromised machine is to stop every third-party Windows service — effectively disabling security tooling — before it begins encryption. It then deletes Volume Shadow Copies, eliminating the routine Windows mechanism that would normally allow file restoration.

Investigators concluded the initial-access vector was an unpatched Pulse Connect Secure VPN appliance — most likely the long-disclosed CVE-2019-11510, the same flaw used in Travelex and several other major ransomware operations.

Because Hillel Yaffe is a government-owned hospital, it was prohibited from paying the ransom. The hospital operated on degraded systems while staff reverted to manual workflows. The incident triggered an immediate spike in attempted cyberattacks against the rest of the Israeli healthcare sector: within days, Israel's national cyber authority reported a 72% week-over-week increase in attempted attacks and identified attempts against nine more hospitals.

Impact

• First confirmed successful ransomware attack on an Israeli healthcare entity.
• Hospital IT paralysed; reverted to manual workflows.
• Months of degraded operations before full recovery.
• Triggered a 72% week-over-week spike in attempted attacks against Israeli healthcare.
• Initial-access vector: unpatched Pulse Secure VPN appliance.

Why it matters

Hillel Yaffe became Israel's reference case for healthcare-sector ransomware preparedness. The attribution to a Chinese criminal group also distinguished the case from the more common Russian-speaking ransomware ecosystem and showed that healthcare is a target across the financially-motivated landscape, not only from one geography. The follow-on attempts against nine more hospitals — most defended successfully — became a case study in post-incident sector-wide alerting that other governments have adopted.