Ransomware – Odense Universitetshospital (via IT-Hotellet)

On 31 May 2024, ransomware struck IT-Hotellet, an external supplier hosting support systems for Odense Universitetshospital from a converted bunker outside Odense. OUH's own clinical network was not the target, but the supplier ran the hospital's CTS systems — the building management controlling electricity, water, heat, cooling and lighting — along with a door access control system.

Operations, consultations and treatments were cancelled. Staff fell back to manual processes, delaying procedures and raising the risk of error. The supplier was hit a second time while recovering from the first attack.

Costs ran to several million DKK, and OUH stated it would take years to return the affected building systems to normal operation.

The most consequential Danish healthcare incident to date, and a sharp illustration that "not clinical systems" does not mean "not clinically relevant" — losing heating, cooling and door access is a patient safety problem regardless of which network the ransomware landed on.

• DR — Stort hackerangreb mod Odense Universitetshospital får omfattende konsekvenser
• Ingeniøren — Hackerangreb mod OUH efterlader skjult millionregning og årelangt teknisk efterslæb
• TV 2 — Dansk firma mistede alt ved dobbelt hackerangreb
• ITWatch — Odense Universitetshospital påvirket af ransomware-angreb
• Version2 — Hackere retter skytset mod sundhedssektoren