Brno University Hospital forced offline after major cyberattack during COVID-19 surge

In the early hours of Friday 13 March 2020, University Hospital Brno (Fakultni nemocnice Brno), one of the largest hospitals in Czechia, was hit by a major cyberattack that forced staff to power down the institution's entire IT network. According to Healthcare IT News, computers were ordered switched off after systems began failing one after another, and the hospital's IT infrastructure had to be taken offline to contain the incident. Two affiliated sites, the Children's Hospital and the Maternity Hospital, were also affected.

The disruption struck during the first weeks of the COVID-19 outbreak. As Computer Weekly reported, the hospital cancelled all planned operations and diverted acute patients to other facilities, while losing the ability to move information from clinical systems into its databases. Brno was one of Czechia's main COVID-19 testing laboratories, and BleepingComputer noted that processing of coronavirus test results was delayed while the systems were down, with prescriptions and records temporarily handled on paper.

The Czech National Cyber and Information Security Agency (NUKIB) confirmed the incident and, together with police, worked with hospital management to investigate and restore operations. The exact nature of the attack was not established at the time. Because staff were forced to shut systems down, reporting widely treated ransomware as the likely cause, though this was not confirmed and no perpetrator was identified.

The Brno attack is one of the most cited early-pandemic strikes on a hospital, notable for hitting a leading COVID-19 testing site at a moment of acute strain. Despite extensive reporting, the perpetrator was never publicly confirmed. Ransomware was widely suspected from the symptoms, but no group claimed responsibility and no state actor was ever substantiated. It is best recorded as an attack of unknown origin. The case illustrates how healthcare infrastructure can be paralysed, with surgeries cancelled and patients diverted, regardless of whether the motive was criminal or strategic.