Many major hospitals were attacked by cyberattacks, patient data was sold.

At a recent seminar on the need and organization of cybersecurity training in Vietnam organized by the Institute of Non-Traditional Security, School of Business Administration - Hanoi National University, experts said that the use of cyberspace to commit crimes has increased in number, nature, severity and by many sophisticated methods and tricks, causing many victims to lose huge amounts of money.

Many large hospitals were attacked by cyberattacks, patient data was sold - 1

Cybercrime targets key agencies and organizations, including the medical sector . According to reports in Vietnam, cyber attacks on the medical system occurred at the An Giang Provincial General Hospital, the hospital's virtual server system was hacked, causing all data to be encrypted, the system to be suspended, and unable to operate.

In March 2024, a number of foreign virtual IPs attacked the website for online medical examination numbers of Ho Chi Minh City Heart Hospital, forcing the hospital to close the number-taking system to fix the problem and run a backup system.

According to information from the cybercrime forum, in June 2024, hackers sold information on 112,000 patient and medical staff records of Hong Ngoc General Hospital, including names, contact information, medical records, and financial information.

Not stopping there, many HIS servers of Bach Mai Hospital were hacked, containing many coin mining malware codes, or the University of Medicine and Pharmacy Hospital in Ho Chi Minh City had its personnel information and a list of more than 50 servers leaked online...

In October 2024, hackers attacked the network system of Duc Giang General Hospital and encrypted a total of 9 servers, causing the hospital to lose a large amount of data and paralyzing the hospital system.

In January 2025, the HIS hospital management system at the Hue Central Hospital's International and On-Demand Treatment Center was attacked, encrypting more than 500GB of data and demanding payment to decrypt the data.

According to experts' analysis, these risks come not only from outside sources but also from medical staff's limited awareness of cybersecurity.

Many medical examination and treatment facilities have not fully implemented information security measures as prescribed, including management measures and prescribed technical measures.

Lieutenant Colonel Le Xuan Thuy, Director of the National Cyber Security Center (A05), Ministry of Public Security, said that recently, a hospital in Vietnam had to 'call for help' because it was attacked by hackers, threatening to publicly disclose patient data and medical examination and treatment history on the Internet.

“No patient wants their private life to be posted online. This directly affects the community. The problem is not that hospitals do not see the risk, but that there are no legal regulations to regulate them so that they have to pay proper attention,” said Mr. Le Xuan Thuy.

According to Mr. Thuy, in the first 6 months of 2025, there has been a trend of ransomware attacks on systems in the energy, healthcare, government agencies and recently, even news agencies.

From this reality, he believes that the development of national standards on network security TCVN 14423:2025 is a core step in state management, to both orient and protect important information systems.

“Standards are not just for testing. More importantly, they guide, direct and help organizations protect their infrastructure,” Mr. Thuy emphasized.

According to him, many organizations are aware of cyber security risks but are confused about where to start.

Large technology companies such as VNPT and MobiFone can refer to global companies to do this. But for companies and organizations that do not know where to start, there needs to be a clear standard that is suitable for Vietnamese practice as a basis for application.

“We set standards based on the safest information, but we also understand that not every organization can immediately comply with all of these standards. Just like the story of not everyone running 5km every day to be healthy. Hopefully, this standard will be a factor to help units increase their maturity level and ensure network security,” said Mr. Thuy.

TCVN 14423:2025 is the first standard in the system of national standards on cybersecurity that the National Cyber Security Center has developed to continue helping agencies and organizations comprehensively deploy cybersecurity measures.

In particular, A05 chose to issue it as a "standard" instead of a "regulation", which is not mandatory, in order to create conditions for organizations and businesses to gradually adapt and improve their infrastructure protection capacity.

However, for units with large personal data and great influence in the community, Mr. Thuy affirmed that there should be mandatory sanctions.

“When an organization is classified as seriously or very seriously affected, the application of standards will be mandatory and there will be specific legal documents,” said Mr. Thuy.

The issuance of TCVN 14423:2025 is not only a technical step forward but also demonstrates the role of state management in creating a legal corridor, helping agencies and organizations proactively protect the system, contributing to protecting national sovereignty in cyberspace.

(Source: Vietnamnet)

Source: https://vtcnews.vn/nhieu-benh-vien-lon-bi-tan-cong-mang-du-lieu-benh-nhan-bi-rao-ban-ar967815.html