How 100 Romanian hospitals switched to pen and paper to defeat a national cyber-attack

In February 2024, a severe cyber-attack struck Romania's healthcare system, affecting more than 100 hospitals. The attackers breached Bucharest-based software firm RSC, infiltrating the widely used medical system Hippocrates, which manages everything from patient admissions to lab tests and pharmacy logistics. The ransomware, called BackMyData, encrypted files and demanded a ransom of €160,000 in bitcoin.

Staff at Pitești children's hospital first noticed errors on Sunday morning, and by Monday, many hospitals reported that Hippocrates was down. Dan Cimpean, head of Romania's Cyber-Security Directorate (DNSC), made the difficult decision to order all affected hospitals to disconnect from the internet immediately. This stopped the spread of the malware and bought time to assess the damage.

Medical personnel had to switch to pen and paper, improvising workarounds to protect patients. Surgeon Oana Goidescu from Buzău Hospital described the experience as unpleasant, as all digital patient records were lost. Some doctors noted that the transition to analogue processes was easier because Romania had only recently digitized its systems.

Cyber-investigators worked through the night and found that 26 hospitals had been infected. Uninfected hospitals were brought back online the next day with added protections. Public messaging urged patients to avoid hospitals unless necessary. The national decision was not to pay the ransom. IT teams restored systems from backups, and within five days, most hospitals were back to normal operations. No deaths or serious harm were reported, though some data was lost forever.

The DNSC credited the success to regular data backups and effective media communication. This incident has become a case study for disaster planners worldwide. Police are still investigating, but in 2023, a ransomware gang linked to BackMyData had its website taken down, and four Russians were arrested outside Russia. The FBI has stated that healthcare is now the most targeted critical infrastructure sector globally.