More than 100 Romanian hospitals successfully mitigated a massive ransomware attack in February 2024 by disconnecting from the internet and reverting to manual, paper-based patient care procedures.

Key Points

• Hackers targeted the Hippocrates medical software, infecting 26 hospitals with the BackMyData ransomware strain.
• Romania’s National Cyber-Security Centre (DNSC) ordered over 100 hospitals to disconnect from the internet to contain the breach.
• Attackers demanded a ransom of €160,000 in bitcoin, but the government mandated that no payments be made to the criminals.
• Medical staff maintained patient care using manual records, Excel, and paper-based lab results during the four-day emergency period.
• Most hospitals restored operations within five days using recent data backups, with no reported patient deaths or serious harm.

Why it Matters

This incident serves as a critical case study for global disaster planners on the necessity of maintaining offline protocols and regular data backups in digitized healthcare systems. It highlights the growing vulnerability of medical infrastructure to ransomware and demonstrates that decisive, coordinated government intervention can prevent catastrophic outcomes without yielding to criminal extortion.