Osaka General Medical Center ransomware (2022) — a contractor's VPN as the way in, and hospital BCP

We read a real, public incident not as a news rerun but through "how would you defend against this?" This is an explainer based on public records (the official investigation committee report and reporting). Sources are listed at the end; we do not include attack how-to or personally identifying details. Contractor and vendor names are not the point, so we describe them by role rather than naming them.

What happened (in plain terms)

Ransomware encrypts systems to make them unusable and demands payment to restore them. Here, what was breached first was not the hospital itself but a contractor's connection. On the server of the company that supplied patient meals sat a VPN device for remote maintenance. Per the committee's report, that device was left unpatched and could be entered using previously leaked credentials.

The hospital's EMR and the contractor's system were constantly connected to exchange data such as meal counts. So if the contractor was breached, the attacker could reach inside the hospital. The contractor's weakness was the hospital's weakness. Once inside, the report explains why the damage spread across the entire EMR: login credentials were shared, many users held administrator rights, critical servers had no antivirus, and the network was not adequately segmented. Once attackers got in at one point, little inside stopped the spread, and the encryption propagated fast. Outpatient care stopped, planned surgeries were cancelled, emergency intake was restricted, and full EMR recovery took over two months.

Each stage of the attack and how to stop it

This too was a chain with a stop point at every stage. Read it not as attack steps but as where it could have been broken.

Published timeline

1. 2022-10-31

   A failure in the contractor's system in the early hours, followed by the hospital's EMR failure. Confirmed as ransomware; systems were shut down to stop the spread.

2. 2022-11

   Outpatient care largely stopped, planned surgeries cancelled, emergency intake restricted to severe cases. Care continued on paper.

3. 2022-12

   Core systems restarted in stages; outpatient care resumed progressively.

4. 2023-01-11

   Systems including the EMR were largely fully restored — over two months to full recovery.

5. 2023-03-28

   The information-security incident investigation committee published its report, citing the entry path, the factors behind the spread, and the belief that "a closed network is safe."

Root cause: not just the entry point, but contractor oversight and how the damage spread

Writing this off as "the hospital's VPN got hit" misses the point. The attackers came in through the contractor, but what spread the damage across the entire EMR was the internal setup: shared credentials, excessive rights, weak segmentation. The real question is whether damage could have been contained once someone got in.

Preventing a repeat in your environment

This applies well beyond hospitals, to any organization with contractor or maintenance connections. In priority order:

Where this overlaps with this site's design principles

The takeaway is that your defense does not end at your own organization: a contractor's or maintenance connection becomes part of your attack surface. That is the opposite of this site's own principles: limit how far damage can spread if one part is breached, isolate what matters, keep connections and privileges minimal. "A closed network is safe" carries the same danger as one shared password reaching every server, or a single point of failure. Inventory what connects to you, end reuse, segment by importance, and prepare to keep going when things stop. These are defenses anyone can implement, regardless of size or sector.

Sources (public records)

The facts here are based on the public information below. We do not include attack how-to, personally identifying details, or contractor/vendor names — only the defensive lessons.

• Osaka Prefectural Hospital Organization, Osaka General Medical Center — "Information Security Incident Investigation Committee Report" (published March 28, 2023) — gh.opho.jp
• Reporting (entry via the contractor's maintenance VPN, shared passwords, the "closed network is safe" belief, and the recovery, 2022–2023) — based on the official committee report

Read next

• Hospitals in 2026: care disrupted by cyberattacks (US, Belgium, Japan) and downtime procedures
• When the VPN is the way in: VPN appliances are the biggest way in — remote access defense after the Digital Agency breach
• Glossary: what ransomware is (how it works and how to avoid paying) / what EDR is (endpoint/server detection)
• Practice: backup basics (the 3-2-1 rule) / the organizational security baseline (segmentation, least privilege)
• Cases: Handa Hospital ransomware (2021) (an unpatched VPN CVE and backup isolation) / KADOKAWA ransomware (2024) (thin segmentation spread it company-wide) / Capcom ransomware (2020) (an old VPN device was the way in) / Codecov supply-chain (2021) (abuse of a trusted path)