Former Hospital Network Administrator Carries Out Revenge Attack, Crippling Xi'an Hospital's Diagnostic Systems

From March to May 2023, a hospital in Xi'an's Lianhu District experienced repeated network failures affecting the reception desk, examination rooms, pharmacy, and electronic medical records, eventually leading to a complete shutdown of its diagnostic systems.

Hospital staff reported issues such as printers losing network connectivity, CT scanners becoming unusable, and ultrasound machines failing, with the problems persisting intermittently until the entire system was paralyzed.

Initial investigations by the hospital's network engineer suggested that important system files had been altered and patient records deleted, prompting the hospital to report the incident to the Lianhu Public Security Bureau on May 15.

The police quickly formed a joint task force, collected nearly 100,000 attack logs, and extracted 1.2 TB of electronic evidence, identifying multiple suspicious IP addresses that had repeatedly logged into the hospital's computers and modified or deleted critical files.

Investigators identified a 41‑year‑old former network administrator, referred to as Bai, as the primary suspect, noting that he had expressed resentment after hearing a senior leader downplay the importance of his position during his resignation.

Motivated by revenge, Bai used his self‑taught networking knowledge to illegally access the hospital's internal servers and perform remote destructive actions, targeting core components of the medical information system.

Police described Bai's actions as a “show‑off” style retaliation, emphasizing his deep familiarity with the system from his involvement in its early development, which allowed him to conduct targeted sabotage.

After gathering sufficient evidence, authorities seized Bai's computer, mobile phone, hard drive, and the malicious software used, and he was detained on charges of destroying computer information systems; the Lianhu District Procuratorate subsequently approved his arrest, and the case remains under further investigation.