Immediate consequences for healthcare
Right after the attack was discovered, all servers were shut down as a precaution to prevent further spread of the ransomware. This led to drastic measures:
- Surgeries halted: around 160 scheduled operations per day could not initially proceed.
- Emergency department disrupted: the emergency department, the second largest in Antwerp, faced severe problems for weeks because services such as radiology were unavailable.
- Patient transfers: five patients had to be immediately transferred to nearby hospitals to ensure continuity of care.
The crucial role of the Citymesh Flex team
Because regular digital communication lines and networks were completely shut down, the hospital had to revert to pen and paper. To restore digital support for the most critical processes, network specialists from Citymesh were called in.
Within 24 hours of the cyberattack, the Citymesh Flex team was on site. This team is known for its expertise in rapidly setting up temporary network infrastructures in challenging environments, such as large music festivals and events. They applied these specific skills in the hospital setting:
- Ad hoc infrastructure: the team installed temporary networks in as many as 15 different locations within the hospital.
- Segmentation: by setting up these independent emergency networks, digital communication (both internal and external) became possible again. Some cloud-based processes were restored.
- Speed: thanks to their “event experience,” they were able to restore connectivity in a fraction of the time a regular IT restart would require, focusing on the most critical areas.
Step by step, in consultation with the hospital, systems were adjusted, expanded, and eventually phased out again.
Together with the Belgian Centre for Cybersecurity (CCB) and the Federal Police, efforts were made toward a secure and permanent recovery. Thanks to excellent backups, it was possible to return to normal operations relatively quickly.
Although the website and most healthcare applications were back online after a month, the aftereffects are still being felt. All handwritten records must be retrospectively entered into the system, and the hospital expects it will take until the end of May 2026 for all systems to be fully restored.
