A coordinated ransomware attack disrupted operations across 340 healthcare facilities operated by Fresenius Health Partners in Germany, France, and the Netherlands on September 1, 2026, forcing the cancellation of approximately 12,000 scheduled surgeries and medical procedures. ## Healthcare Sector Hit by Largest European Cyberattack in History The attack, attributed to the BlackSuit ransomware group, encrypted critical systems including electronic health records, medication dispensing equipment, and radiology imaging networks. Fresenius CEO Michael Sen stated that patient data for approximately 2.8 million individuals may have been compromised in the breach. "This is the most significant cyberattack on European healthcare infrastructure in history," Europol Executive Director Catherine De Bolle said at a press conference in The Hague. "Patient safety is our top priority, and we are working around the clock to support affected facilities." Fresenius reported that the attackers demanded a ransom of 50 million dollars in cryptocurrency, which the company has refused to pay. "Paying ransomware demands emboldens criminals and does not guarantee data recovery," Sen said in a public statement. "We are restoring systems from backups and will not negotiate with attackers." ## Operational Impact and Patient Care Disruptions The attack forced emergency departments at 87 hospitals to divert ambulances to unaffected facilities, creating patient transfer logistical challenges across three countries. Germany Federal Office for Information Security, known as BSI, issued a nationwide alert requiring all healthcare providers to verify their network security protocols. Dr. Klaus Wiegers, chief medical officer at Frankfurt University Hospital, one of the affected facilities, described the operational chaos. "We reverted to paper-based medication orders for the first time in 15 years," Dr. Wiegers said. "The radiology department was completely offline for 36 hours, requiring us to postpone cancer staging scans for 340 patients." The German government activated its national crisis management center, with Interior Minister Nancy Faeser calling the attack "an assault on the foundations of our healthcare system." France Agence du Numerique en Sante dispatched technical teams to 42 affected French hospitals, while the Netherlands Health and Youth Care Inspectorate issued emergency directives to all 93 Dutch facilities under Fresenius management. ## Investigation and Industry Response Mandiant incident response team, hired by Fresenius, identified the attack vector as a compromised VPN credential obtained through a phishing campaign targeting an IT administrator in March 2026. The attackers operated within Fresenius network for approximately four months before deploying the ransomware payload, a tactic known as dwell time that allowed them to map critical systems and exfiltrate data. "The threat actors maintained persistent access through a stolen VPN account that did not have multi-factor authentication enabled," said Charles Carmakal, senior vice president at Mandiant. "This is a preventable vulnerability that the healthcare sector continues to struggle with." The attack has reignited calls for mandatory cybersecurity standards in healthcare. The European Commission proposed in July 2026 a directive requiring all healthcare providers to implement zero-trust network architectures by 2028. Industry group HIMSS Europe estimated that the average European hospital spends only 4.2 percent of its IT budget on cybersecurity, compared to the recommended 12 percent. Fresenius shares dropped 7.8 percent on the Frankfurt Stock Exchange following the disclosure, wiping approximately 2.4 billion euros in market value. The company projected a full recovery of systems within 6 to 8 weeks, at an estimated cost of 180 million euros for remediation, legal fees, and enhanced cybersecurity infrastructure.