The Attack and Immediate Response
In February 2024, Romania faced one of the most severe cyber attacks on healthcare infrastructure globally. The attack targeted a widely used medical software system called Hippocrates, developed by Bucharest-based firm RSC. The ransomware strain BackMyData infiltrated the system, encrypting files and demanding a bitcoin ransom. As the attack spread across the country, Romania’s national cyber security centre (DNSC) made a critical decision: order over 100 hospitals to disconnect from the internet immediately. This drastic step halted the spread of the malware but forced medical staff to revert to pen and paper for all operations, including patient records, lab test requests, and pharmacy logistics.
Impact on Patient Care and Hospital Operations
For healthcare professionals like surgeon Oana Goidescu at Buzau Hospital, the attack was deeply disruptive. With the Hippocrates system down, access to patient records, lab results, radiology reports, and medication management was completely lost. Staff improvised by developing offline registration methods, using Excel spreadsheets and paper forms to maintain care continuity. Some doctors noted that Romania’s relatively recent shift to digital systems actually helped, as staff still remembered analog workflows. The DNSC used media channels to urge non urgent patients to avoid hospitals, though waiting rooms remained crowded and some patients directed their frustration at healthcare workers. Crucially, the national decision to refuse the 160,000 euro bitcoin ransom and avoid contacting the attackers proved effective.
What This Means for Healthcare Organizations
This incident serves as a critical case study for hospital CISOs and healthcare security teams worldwide. The attack demonstrates that healthcare remains the most targeted critical infrastructure sector, as confirmed by the FBI. Key lessons include the importance of maintaining recent, offline backups which enabled most Romanian hospitals to restore systems within five days without paying the ransom. The fact that no deaths or serious harm were reported during this crisis is remarkable, especially compared to other incidents like the UK NHS blood testing hack that contributed to a patient’s death. For healthcare compliance officers, this highlights the need for robust business continuity plans that include non digital fallback procedures, regular backup testing, and clear communication protocols with both staff and the public during cyber emergencies. Hospital security teams should evaluate their own medical software supply chain risks, as the attackers compromised hospitals through a trusted third party software vendor.
Source: BBC News
