Romanian hospitals ransomware wave

In the early hours of 12 February 2024, a ransomware attack struck the Hipocrate Information System (HIS) — a hospital management platform used across Romania — encrypting patient and administrative data at 25 hospitals and forcing roughly 75 more to pull their systems offline. In total over 100 healthcare facilities were affected, in what Romania's cyber authority called one of the most disruptive incidents ever to hit the country's health sector.

What happened

The attackers deployed Backmydata, a variant of the Phobos ransomware family, against the production servers running HIS, software developed and operated by the Romanian vendor Romanian Soft Company (RSC). Because dozens of hospitals shared the same centrally-hosted platform, a single compromise cascaded across the network — a textbook third-party / supply-chain failure in critical infrastructure.

Symptoms first surfaced on 10 February at the Pitesti Pediatric Hospital, then spread overnight on 11-12 February. Some 400 computers and servers were encrypted. The ransom note demanded 3.5 BTC — about 157,000 euro (roughly 170,000 USD) at the time — for a decryptor and a pledge not to publish stolen data. It carried only an email address and named no group.

Impact

• 25 hospitals had data encrypted; about 75 additional facilities, including cancer, cardiology and pediatric centres, disconnected HIS as a precaution.
• Affected hospitals reverted to paper records for prescriptions, admissions and documentation, slowing care for days.
• The targeted sites ranged from major Bucharest hospitals to regional and emergency facilities.

Response

Romania's National Cyber Security Directorate (DNSC), together with national intelligence and police cyber units, led the response. Critically, the DNSC reported that most affected hospitals held recent backups — data saved one to three days earlier, with a single outlier at twelve days — which made recovery feasible without paying the ransom. Authorities publicly advised against payment and against negotiating with the attackers.

There was no confirmed exfiltration of patient data at the time of reporting; the incident was primarily an encryption-and-extortion event rather than a mass data leak. Hospitals restored HIS from backups over the following weeks.

Why it matters

The episode is a landmark national healthcare resilience case. It showed how a shared software platform can turn one ransomware infection into a country-wide outage, and how disciplined offline backups plus a no-pay policy can blunt extortion. It accelerated Romanian and EU scrutiny of cybersecurity obligations for healthcare providers and managed software vendors under the NIS2 Directive, and became a frequently-cited example of why centralised health-IT systems need segmentation, tested recovery, and vendor accountability.