Bajaj Hospital ransomware attack: all 9 servers encrypted, sensitive patient data stolen
Severity: high · Patch status: no-fix-needed · Since 2026-10-27
Hackers attacked the digital systems of Kamalnayan Bajaj Hospital around 3 am, breaching all nine of the hospital's servers and encrypting their entire data in what appears to be a ransomware extortion attempt. Sensitive data was reportedly stolen in addition to the encryption, putting patient information and hospital operations at risk. The attack sent shockwaves through the city and disrupted the hospital's digital services. No ransomware group has been named in reporting, and no CVE applies; this is a breach/ransomware incident rather than a software vulnerability. Remediation depends on the hospital's incident response, restoration from backups, and law enforcement involvement; no vendor patch is applicable.
What to do
- Isolate affected servers and preserve forensic evidence before any rebuilding
- Determine the ransomware strain and check for a free decryptor (e.g. No More Ransom)
- Restore systems from clean, offline backups after verifying no persistence remains
- Assess scope of stolen patient data and prepare breach notifications per applicable law
- Harden remote access, enforce MFA, patch exposed services, and segment hospital networks
- Report the incident to law enforcement/CERT-In and engage IR specialists
Sources
All live incidents on Threat Watch
