Play ransomware gang targets Antwerp's IT solutions provider, disrupts municipal & healthcare services

Digipolis, the IT partner of the city of Antwerp, Belgium, suffered a cyber attack that has crippled the daily operations of the city.

According to Belgian news agencies, threat actors targeted Digipolis between December 5th and December 6th and disrupted several citizen-oriented services. These included appointments with the Population Service or recording visits to the container park. Citizens, could, however, use the emergency helpline numbers 101 and 112 to contact the police or call the fire brigade but the e-forms of the fire brigade were unavailable.

The IT system of Zorgbedrijf, Antwerp, was also impacted by the cyber attack. Urban education and the residential care centers of the Zorgbedrijf were temporarily offline following the security incident.

“The server problems as a result of a cyber attack have not yet been resolved, but thanks to an emergency solution, Zorgbedrijf can once again be reached by telephone with a LIMITED amount. In some centres it is temporarily not possible to pay with Bancontact,” reads an auto-translated text on Zorgbedrijf’s website.

In a statement, Zorgbedrijf’s CEO, Johan De Munck, said, “The only thing that has really affected us is that our healthcare providers in our eighteen residential care centres have switched back to pen and paper. Medication to the elderly is once again provided on the basis of traditional paper prescriptions. Normally that medication is automatically prescribed and stored in the computer, but that is not possible at the moment. Doctors now have to sign prescriptions that we then deliver to the pharmacy. Lots of paperwork but everyone gets their medication today.

“My estimate is that everything can go automatically again tomorrow morning. There was no need to worry about hacking and leaking our patient data. Those databases were not affected by the cyber attack,” Munck added.

The cyber attack also affected the administrative software of the city including the Outlook application. This prevented city and police employees from accessing email services.

The Play ransomware gang has claimed responsibility for the cyber attack on Digipolis. Over the weekend, the threat actors listed Antwerp as one of its victims on its data leak site. According to a screenshot shared by Brett Callow, the Play ransomware gang has apparently stolen 557GB of data from the Belgium city. The stolen database includes sensitive personal information including passports, IDs, and financial documents. The gang is yet to publish the stolen data but is threatening to leak the same on December 19 if its ransom demand isn’t met.