{"id":7398,"date":"2025-03-03T09:00:00","date_gmt":"2025-03-03T09:00:00","guid":{"rendered":"https:\/\/www.securitytoday.de\/2026\/04\/02\/post_id-3699-2\/"},"modified":"2026-07-04T12:24:12","modified_gmt":"2026-07-04T12:24:12","slug":"case-study-hospital-thwarts-cyberattack-thanks-to-ot-segmentation","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2025\/03\/03\/case-study-hospital-thwarts-cyberattack-thanks-to-ot-segmentation\/","title":{"rendered":"Case Study: Hospital Thwarts Cyberattack Thanks to OT Segmentation"},"content":{"rendered":"

A maximum care hospital became the target of a cyberattack. The attackers compromised the administrative network but failed due to the segmentation of medical technology. Hospital operations continued uninterrupted.<\/strong><\/p>\n

TL;DR<\/h2>\n

A maximum care hospital was targeted by a cyberattack in January 2025. The attackers compromised the administrative network but failed due to the segmentation of medical technology. Hospital operations continued uninterrupted – a success that goes back to two years of preparation.<\/p>\n

Initial Situation<\/h2>\n

The hospital is a maximum care facility with 1,100 beds and around 4,500 employees. As a KRITIS operator in the healthcare sector, it is under special regulatory supervision. The IT infrastructure includes approximately 2,500 endpoints, 200 servers, and around 3,000 medical devices.<\/p>\n

Two years ago, the hospital initiated a segmentation project: strict separation of administrative IT, clinical systems, and medical technology into separate network zones.<\/p>\n

The Attack<\/h2>\n

Initial access was gained through a compromised webmail account. The attackers (presumably a LockBit affiliate) moved laterally within the administrative network and compromised the Active Directory server. At 23:40, they began the encryption process.<\/p>\n

What Segmentation Prevented<\/h2>\n

Although the administrative network was significantly affected, all critical systems remained operational:<\/p>\n