Tsurugi Handa Hospital ransomware (2021) — an unpatched VPN CVE and backups encrypted along with production

We read a real, public incident not as a news rerun but through "how would you defend against this?" This is an explainer based on public records (the official expert-committee report and reporting). Sources are listed at the end; we do not include attack how-to or personally identifying details. Vendor and contractor names are not the point, so we describe them by role rather than naming them.

What happened (in plain terms)

Ransomware encrypts systems to make them unusable and demands payment to restore them. The way in here was not a sophisticated zero-day. On a VPN device the hospital exposed to the internet sat a vulnerability public since 2019 (CVE-2018-13379), still unpatched. Worse, that flaw had previously enabled a credential leak, and the hospital's device was on the leaked list. A long-unpatched public vulnerability plus leaked credentials that were never revoked made it easy for the attacker to get in.

Once inside, the report explains why it spread: short passwords, no login lockout, and users holding administrator rights. Once one machine was compromised, the attack could spread across the hospital with admin rights. And the worst part: the primary system and its backup were on the same network, and both were encrypted. The backup that was supposed to be there was encrypted along with production and could not be used for recovery. The EMR stayed down, and normal care resumed only after about two months.

Each stage of the attack and how to stop it

This too was a chain with a stop point at every stage. Read it not as attack steps but as where it could have been broken.

Published timeline

1. 2021-10-31

   In the early hours, printers spooled ransom notes; the EMR and billing systems went down. A press conference was held the same day.

2. 2021-11

   Care continued on paper. Investigation and recovery support began; data restoration was reported as feasible.

3. 2021-12

   Restoration of EMR data was confirmed; recovery work proceeded in stages.

4. 2022-01-04

   Systems were brought back and normal care resumed — about two months after the infection.

5. 2022-06

   The expert committee published its investigation report, citing the entry path (an unpatched VPN vulnerability), the backup design, and the belief that "a closed network is safe."

Root cause: not just the entry point, but missing basic controls

Writing this off as "the hospital's VPN got hit" misses the point. What was used was a known, public vulnerability — not a novel, sophisticated attack. Entry, spread, and failed recovery all stemmed from neglected basics: patching, credentials, and backup isolation. The report strongly criticizes selling and running an extremely vulnerable system without keeping it updated (we do not name the vendor). But the enduring point is this: even when you outsource operations, the risk remains yours.

Preventing a repeat in your environment

This applies well beyond hospitals — to any organization with internet-facing devices and backups. In priority order:

Where this overlaps with this site's design principles

The main point is that neglected basics, not a sophisticated attack, decided the damage: patch known CVEs, manage credentials properly, isolate backups. None of it is new or hard. That is the opposite of this site's own principles: fix known vulnerabilities fast, don't reuse credentials, keep a recoverable setup. In particular, "we have a backup, but it's in the same place as production" carries the same danger as one API key reaching every dataset. Patch internet-facing devices, manage credentials tightly, and isolate backups and rehearse recovery. These are defenses anyone can implement, regardless of size or sector.

Sources (public records)

The facts here are based on the public information below. We do not include attack how-to, personally identifying details, or vendor/contractor names — only the defensive lessons.

• Tsurugi Handa Hospital — "Expert Committee Investigation Report on the computer-virus infection incident" (published 2022) — handa-hospital.jp
• Reporting and analysis (entry via an unpatched VPN vulnerability CVE-2018-13379, backup on the same network, the "closed network is safe" belief, and the recovery, 2021–2022) — based on the official committee report

Read next

• Hospitals in 2026: care disrupted by cyberattacks (US, Belgium, Japan) and downtime procedures
• When the VPN is the way in: VPN appliances are the biggest way in — remote access defense after the Digital Agency breach
• Glossary: what ransomware is (how it works and how to avoid paying) / what a CVE is (managing known vulnerabilities)
• Practice: backup basics (the 3-2-1 rule) / CVE remediation playbook / the organizational security baseline
• Cases: Osaka hospital ransomware (2022) (a contractor's VPN and medical BCP) / Capcom ransomware (2020) (an old VPN device was the way in) / KADOKAWA ransomware (2024) (thin segmentation spread it company-wide)