AZ Monica hospital (Antwerp) ransomware attack cancelled procedures and moved critical patients
Belgium's AZ Monica hospital shut its servers on 13 Jan 2026 after a cyberattack, cancelling surgery and moving seven critical patients. Systems were largely back by mid-February; no ransom paid, no confirmed data theft. Nothing for families to do.
Nothing for you to do. If you were a patient and get a notice from AZ Monica, follow its instructions, and be wary of unexpected calls or messages about your records.
What’s happening
On 13 January 2026 AZ Monica, a hospital on two campuses in Antwerp and Deurne, Belgium, shut down all its servers after a cyberattack. Scheduled surgery was cancelled, the emergency department ran at reduced capacity, doctors lost access to electronic patient records, and chemotherapy and imaging were postponed. The Red Cross helped move seven critical-care patients to other hospitals. The prosecutor confirmed a cyberattack; a prosecutor description reported by VRT NWS called it ransomware, with no ransom demanded though the attackers left a message. By 14 January the hospital was at about 50% capacity. A secondary summary dated 18 February says core clinical systems were largely restored about a month on, the hospital did not pay, and there is no confirmed patient-data theft. That summary is not from the hospital, and the prosecutor's investigation is ongoing. How the attackers got in has not been made public. I found no later update.
- What
- Breach
- Affects
- AZ Monica hospital, Antwerp and Deurne, Belgium
- Fixed in
- Nothing to patch
- Since
- 13 Jan 2026
- Closed
- 18 Feb 2026
Timeline
- All clearNothing to patch
Cyberwarzone, summarising Security.NL and VRT NWS reports, said core clinical systems (records, imaging, e-prescriptions, emergency systems) were largely restored about a month after the attack. It says the hospital did not pay a ransom and has no confirmed evidence of stolen patient data; the prosecutor's investigation continues and the entry point has not been made public.
- UpdateNothing to patch
VRT NWS reported both campuses running at about 50% capacity, with roughly 30% of planned care going ahead. It said the prosecutor described the attack as ransomware but that no ransom was demanded, although the attackers left a message the hospital did not answer. Servers stayed offline while the hospital checked the entry point was closed.
- UpdateNothing to patch
CEO Geert Smits said the public prosecutor confirmed a cyberattack and that the servers were shut down proactively to protect patient data. Doctors could not reach electronic records, and chemotherapy and imaging were postponed. The newspaper GVA reported ransomware, which the hospital had not confirmed.
- Made publicNothing to patch
AZ Monica, a hospital with campuses in Antwerp and Deurne, shut down all its servers at 6:32am after a cyberattack. Scheduled procedures were cancelled, the emergency department ran at reduced capacity, and the Red Cross helped move seven critical patients to other hospitals.
Sources
- Belgian hospital AZ Monica shuts down servers after cyberattackBleepingComputer · 13 Jan 2026
- Belgian hospital cyberattack in Antwerp (AZ Monica)The Record · 13 Jan 2026
- Update AZ Monica Antwerpen Deurne 50 procentVRT NWS · 14 Jan 2026
- Belgian hospital restores systems a month after ransomware attackCyberwarzone · 18 Feb 2026