Tsurugi Handa Hospital ransomware (2021) — an unpatched VPN CVE and the backup trap

We read a real, public incident not as a news rerun but through "how would you defend against this?" This is an explainer based on public records (the official expert-committee report and reporting). Sources are listed at the end; we do not include attack how-to or personally identifying details. Vendor and contractor names are not the point, so we describe them by role rather than naming them.

What happened (in plain terms)

Ransomware encrypts systems to make them unusable and demands payment to restore them. The way in here was not a sophisticated zero-day. On a VPN device the hospital exposed to the internet sat a vulnerability public since 2019 (CVE-2018-13379), still unpatched. Worse, that flaw had previously enabled a credential leak, and the hospital's device was on the leaked list. A long-unpatched public hole plus a leaked key that was never revoked — an open door for the attacker.

Once inside, the report explains why it spread: short passwords, no login lockout, and users holding administrator rights — one foothold could move across the hospital as an admin. And the worst part: the primary system and its backup were on the same network, and both were encrypted. The backup that was supposed to be there went down with production and could not be relied on for recovery. The EMR stayed down, and normal care resumed only after about two months.

The attack chain is also a defense map

This too was a chain with a stop point at every stage. Read it not as attack steps but as where it could have been broken.

Published timeline

1. 2021-10-31

   In the early hours, printers spooled ransom notes; the EMR and billing systems went down. A press conference was held the same day.

2. 2021-11

   Care continued on paper. Investigation and recovery support began; data restoration was reported as feasible.

3. 2021-12

   Restoration of EMR data was confirmed; recovery work proceeded in stages.

4. 2022-01-04

   Systems were brought back and normal care resumed — about two months after the infection.

5. 2022-06

   The expert committee published its investigation report, citing the entry path (an unpatched VPN vulnerability), the backup design, and the "closed-network myth."

The root cause is not just "the entry" — it's neglected basics

Writing this off as "the hospital's VPN got hit" misses the point. What was used was a known, public vulnerability — not a novel, sophisticated attack. Entry, spread, and failed recovery all stemmed from neglected basics: patching, credentials, and backup isolation. The report strongly criticizes selling and running an extremely vulnerable system without keeping it updated (we do not name the vendor). But the enduring point is this: even when you outsource operations, the risk remains yours.

Preventing a repeat in your environment

This applies well beyond hospitals — to any organization with internet-facing devices and backups. In priority order:

Where this mirrors this site's design principles

The core here is that it was neglected basics, not a flashy attack, that decided the damage: patch known CVEs, keep credentials clean, isolate backups — none of it new or hard. That is the inverse of this site's own principles: close known holes fast, don't reuse keys, keep a recoverable setup. In particular, "we have a backup, but it's in the same place as production" carries the same danger as one API key reaching every dataset. Close the external hole, tighten the keys, and isolate and rehearse recovery — defenses anyone can implement, regardless of size or sector.

Sources (public records)

The facts here are based on the public information below. We do not include attack how-to, personally identifying details, or vendor/contractor names — only the defensive lessons.

• Tsurugi Handa Hospital — "Expert Committee Investigation Report on the computer-virus infection incident" (published 2022) — handa-hospital.jp
• Reporting and analysis (entry via an unpatched VPN vulnerability CVE-2018-13379, backup on the same network, the closed-network myth, and the recovery, 2021–2022) — based on the official committee report

Read next

• Glossary: what ransomware is (how it works and how to avoid paying) / what a CVE is (managing known vulnerabilities)
• Practice: backup basics (the 3-2-1 rule) / CVE remediation playbook / the organizational security baseline
• Cases: Osaka hospital ransomware (2022) (a contractor's VPN and medical BCP) / Capcom ransomware (2020) (an old VPN device was the way in) / KADOKAWA ransomware (2024) (thin segmentation spread it company-wide)