How 100 hospitals switched to pen and paper to defeat a national cyber-attack

Romanian Hospital Cyber Attack Highlights Growing Threat to Healthcare Systems

A major cyber attack that crippled hospitals across Romania in February 2024 has become a global case study in how healthcare systems can respond to large-scale digital threats.

The attack targeted Hippocrates, a widely used medical management software that supports hospital operations including patient admissions, laboratory requests, pharmacy management, payroll, and medical records. Cyber criminals deployed ransomware known as BackMyData, encrypting files and demanding a ransom of €160,000 in bitcoin.

As head of Romania's Cyber-Security Directorate Dan Cimpean (L) was in charge of co-ordinating the crisis response

As reports of system failures poured in from hospitals around the country, Romania's National Cyber Security Directorate (DNSC) ordered more than 100 hospitals to disconnect from the internet to prevent the malware from spreading further.

The decision forced healthcare facilities to revert to manual operations. Doctors, nurses, and administrators relied on paper records and offline tools to continue treating patients while cyber experts worked to contain the attack.

"It was quite an unpleasant experience because an IT record is not just a list of patients," surgeon Oana Goidescu said, describing the challenges medical staff faced after losing access to digital systems.

Investigators later confirmed that 26 hospitals had been infected. Authorities urged hospitals not to negotiate with the attackers or pay the ransom, instead focusing on restoring services through backup systems.

Healthcare workers developed emergency procedures to ensure patient care continued uninterrupted. Laboratory results were delivered on paper, and staff manually recorded admissions, prescriptions, and treatments.

Within five days, most affected hospitals had resumed normal operations. Authorities reported no deaths or serious patient harm linked to the incident, although some data was permanently lost.

Cybersecurity experts say the attack underscores the increasing vulnerability of healthcare systems worldwide. Hospitals have become attractive targets for ransomware groups because disruptions to critical medical services can pressure organisations into paying large sums of money.

The Romanian incident comes amid a rise in cyber attacks targeting healthcare institutions globally. Recent attacks on health providers in the United Kingdom and the United States have similarly caused widespread disruption, raising concerns about the resilience of digital healthcare infrastructure.

Experts say regular data backups, robust cybersecurity measures, and clear emergency response plans remain essential in protecting healthcare services from future attacks.