Leak of patient records feared as Israeli hospital hit by cyberattack demanding ransom
Russian-speaking cybercrime group thought behind attack on Assaf Harofeh Medical Center, with ransom message addressed to ‘Bibi and Sara’; hackers said to demand $700,000 in 72 hours
Add ToI as a Preferred Source on Google
The Assaf Harofeh Medical Center in the central city of Beer Yaakov was targeted by a cyberattack over Yom Kippur, according to a joint announcement from the hospital, the Health Ministry and the National Cyber Directorate.
Authorities were investigating the possibility of a leak as a result of the attack.
While the statement said the attack was “blocked in its initial stages,” a Russian-speaking cybercrime organization threatened to publish patient data and demanded a $700,000 ransom.
The Ynet news outlet reported that the attack briefly shut down a medical records system used by hospitals across Israel, including Assaf Harofeh, which is also known as the Shamir Medical Center. The hospital’s core operations continued uninterrupted and it is back to normal, according to reports.
According to the Ynet report, the hack was alleged to have been perpetrated by Qilin, a Russian-speaking cybercrime organization thought to be based in Eastern Europe. The group also hacked into London hospitals last year, according to The Guardian, stopping tests and operations.
Ynet published a message posted by Qilin claiming to have obtained a large amount of data that it threatened to release within three days.
“We have successfully infiltrated and gained full access to your systems at Shamir Hospital, the largest medical facility in Israel,” the post says. “Over the course of our operation, we have exfiltrated approximately 8 terabytes of sensitive and confidential data. This data includes patient records, internal communications, and critical operational information. We demand a ransom payment to prevent this information from being publicly released.”
קבוצת התקיפה Qilin מפרסמת כקרבן את בית החולים שמיר (אסף הרופא).
הקבוצה טוענת כי היא מחזיקה ב-8TB של מידע, חלקו מידע רפואי רגיש. ומציבה דדליין של 72 שעות לתשלום דמי הכופר לפני שהמידע יפורסם. https://t.co/AkAl9PPesT pic.twitter.com/53fjE47ZlG
— חדשות סייבר (@CyberIL) October 2, 2025
The ransom note warned the hospital not to involve law enforcement and added, “Failure to comply with our demands will result in the immediate publication of all stolen data, causing irreparable damage to your institution and compromising patient privacy.”
The records system that was reportedly infiltrated contains data on patient visits and prescriptions, Ynet reported.
The outlet also said the ransom note was addressed to “Bibi and Sara,” referring to Prime Minister Benjamin Netanyahu and his wife, though that text did not appear in the screenshot Ynet published.
The Times of Israel Community.