Romania Disconnected 100 Hospitals During 2024 Ransomware Attack
Summary
In February 2024, Romania disconnected more than 100 hospitals after ransomware spread through the Hippocrates medical system. Twenty-six hospitals were infected; most restored operations within five days, though some data was lost.
Key points
- Attackers breached medical software firm RSC and spread BackMyData ransomware through the Hippocrates system used by hospitals.
- Romania ordered more than 100 hospitals to disconnect from the internet; investigators found 26 hospitals had been infected.
- Hospitals used paper records and offline tools to continue patient care while IT teams worked on recovery.
- The attackers demanded €160,000 in bitcoin; authorities told hospitals not to contact the attackers or pay.
- Most hospitals were operating close to normal within five days, with no reported deaths or serious patient harm; some data was permanently lost.
- The article identifies regular backups as a key recovery lesson. Police have not commented on who was behind this attack.
Article Details
- Victim Organization
- Hospitals across Romania; 26 hospitals were reported infected
- Incident Type
- Ransomware attack on hospitals using the Hippocrates medical system, following a breach of software firm RSC
- Incident Date
- 2024-02-10
- Operational Impact
- More than 100 hospitals were disconnected from the internet as a precaution. Infected systems were unavailable, and medical staff used paper records and offline tools. Most hospitals were back online and operating close to normal within five days; some information recorded during the outage was later lost. No deaths or serious patient harm were reported.
- Ransom Or Extortion
- The attackers demanded €160,000 in bitcoin. A national decision was made not to pay.
- Claim Status
- confirmed
MITRE ATT&CK
People
Alina BÎZGĂA cybersecurity specialist at Bitdefender who discussed why criminals target hospitals for ransom.Dan CimpeanAs head of Romania's Cyber-Security Directorate, he coordinated the crisis response.Mihai RotariuAs head of communications at the national cyber-security centre, he provided media updates during the attack.Oana GoidescuA surgeon at Buzău Hospital who described the impact of the attack on hospital records and patient care.Vlad PaicFrom Carol Davila Hospital, he described the offline processes staff used to register patients and obtain laboratory results.