Deurne (Brussels Morning Newspaper) January 15, 2026 – AZ Monica hospitals in Deurne and Antwerp experienced a ransomware cyberattack detected on January 13, leading to server shutdowns, cancellation of around 70 surgeries, and transfer of seven critical patients. No ambulances transported patients to the sites initially due to reduced emergency capacity, placing significant strain on neighbouring hospitals. Some ambulances have now resumed service at the Deurne campus as pressure on other facilities has grown too great.
AZ Monica, operating campuses in Deurne and Antwerp’s Harmonie area, confirmed the cyber incident struck at 6:32 a.m. on Tuesday, January 13. Hospital staff noticed a serious IT failure, prompting a proactive shutdown of all servers across both sites to contain the breach. The public prosecutor’s office opened an investigation, with the federal police’s cybercrime unit attending the scene.
The hospital network prioritised patient safety during the disruption. Seven patients in critical care were transferred to nearby hospitals with Red Cross assistance, while all other admitted patients remained on site and received ongoing treatment. Emergency departments operated at reduced capacity, with longer registration times due to manual processes replacing inaccessible electronic records.
Cyberattack Triggers Immediate Operational Changes
Mobile Urgency Group (MUG) and Paraprofessional Intervention Team (PIT) services became temporarily unavailable at AZ Monica. These teams, which provide on-scene and en-route emergency care, shifted to provincial emergency plans handled by other hospitals. No patients arrived by ambulance initially, as the hospital advised the public to seek urgent care from general practitioners, out-of-hours clinics, or alternative emergency services.
Around 70 to 80 scheduled surgeries were cancelled on the first day, with patients notified individually for rescheduling. Non-urgent consultations were postponed because staff could not access digital medical files or imaging. Visitors to admitted patients faced no restrictions.
Hospital spokesperson Sofie Braem stated to VRT News that urgent treatments continued despite the challenges. CEO Gert Smits reported at a press conference that ensuring care continuity remained the top priority. The hospital notified the Cyber Emergency Response Team (CERT) and relevant authorities.
Investigation and Ransomware Confirmation
The attack involved ransomware, though no ransom demands had been received at the time of early reports. No patient data leaks occurred due to the swift server shutdown. Police, prosecutors, and the hospital’s IT team continued investigating the incident’s origin and scope.
This marked the first such major cyber incident for AZ Monica. The prosecutor’s office confirmed the cyber nature of the event shortly after detection. Disruptions persisted into Wednesday, January 14, with additional surgeries cancelled.
Belgian healthcare faces frequent threats, reporting 2,620 cyberattacks weekly. AZ Monica emphasised close monitoring and promised further updates as clarity emerged.
Ambulance Diversion Eases with Partial Return
The initial ambulance refusal stemmed from low emergency capacity, redirecting calls to other facilities. This created mounting pressure on neighbouring hospitals, which absorbed extra cases under emergency protocols. Reports indicated the strain became excessive, prompting a policy shift.
Some ambulances began returning to the AZ Monica Deurne campus to alleviate the burden. The hospital noted this adjustment allowed limited resumption while systems remained offline. Emergency services at Deurne operated cautiously, prioritising critical needs.
Provincial coordination ensured coverage during the outage. Patients requiring urgent attention received guidance to use available alternatives where possible.
Ongoing Disruptions and Patient Guidance
As of the latest updates, electronic systems stayed offline, relying on paper records. Surgeries limited to urgent cases only, with non-planned interventions postponed. The Deurne and Antwerp campuses maintained inpatient care without interruption for existing patients.
AZ Monica instructed those needing care to consult GPs first. The hospital’s website remained inaccessible initially. Management focused on restoration efforts alongside the investigation.
Federal authorities supported the response, with no reported compromises to sensitive data. The incident highlighted vulnerabilities in healthcare IT infrastructure.
