When the cyber‑security centre in Bucharest discovered a ransomware strain called BackMyData had infected the widely used hospital management system Hippocrates, more than 100 hospitals across Romania were ordered to cut all internet connections. The move was aimed at stopping the malware from spreading further and bought the authorities time to investigate the breach.
The decision meant doctors, nurses and administrators could not use electronic patient records, laboratory orders, radiology reports or pharmacy logistics. Instead, they went back to paper forms, manual logbooks and face‑to‑face communication. One surgeon, Oana Goidescu, described the chaos: “Every test, medication and supply list vanished from the system.” Staff learned to write patient information by hand, request laboratory results on paper and use offline spreadsheets.
National cyber‑security experts worked overnight with the software vendor to identify all infected sites. A briefing to hospitals and the public urged patients to avoid hospitals unless necessary and to refrain from paying the ransom of €160,000 in bitcoin demanded by the attackers. Over the next four days, the disruption was contained; systems were restored from recent backups, and most hospitals were operational again by the end of the fifth day.
The response highlighted how digitised healthcare systems are a prime target for attackers and why regular, off‑site backups are essential. While some data lost during the outage will never be recovered, no deaths or serious injuries were reported. The incident serves as a cautionary example for disaster planners worldwide, prompting hospitals to prepare contingency plans that include manual processes.
By Joe Tidy – Cyber Correspondent, World Service (reporting from Romania)
