Romanian Hospitals Switched to Paper During Cyber-Attack, Avoided Major Harm
Dozens of hospitals reverted to manual record-keeping for four days to combat a national cyber-attack, ultimately preventing patient harm but resulting in some data loss.
Dozens of Romanian hospitals were forced to revert to pen and paper for four days to combat a national cyber-attack, a move that ultimately prevented serious harm to patients. The attackers had demanded a ransom of 160,000 euros in bitcoin, but a national decision was made not to pay.
While the systems were offline, IT teams worked to restore operations from backups. Most hospitals had relatively recent data copies, a crucial lesson for disaster recovery. Within five days, the majority of hospitals were back online and functioning near normal capacity, with no reported deaths or significant patient harm attributed to the incident. However, the process of manually entering data collected during the outage took weeks, and some information was permanently lost.
Police are not commenting on their investigation into the perpetrators. However, a ransomware group linked to the name "BackMyData" had its website taken down last year in an international operation that resulted in four arrests outside of Russia. The cyber-security firm Bitdefender noted that such attacks on hospitals are financially motivated, as criminals believe the critical nature of hospital services increases the likelihood of ransom payments.
Alina Bîzgă from Bitdefender stated that attacks on hospitals are attractive to criminals seeking to cause chaos for financial gain. "Hospitals handle critical services, and the criminals think that the more disruption that can be caused, the more likely they are to get paid a ransom," she said.
The attack could have occurred anywhere, according to Dan Cimpean, who noted that increased digitization correlates with greater risk. "The more technology you have, the more digitised you are, the greater the risk," Cimpean said.
This incident follows other significant healthcare cyber-attacks. Last year, a hack on a blood testing company that affected several London medical centers was linked to a patient's death, marking the first officially recognized fatality associated with a cyber-attack. Around the same time, Change Healthcare in the United States experienced a significant hack, causing widespread disruption, and ultimately paid a $22 million ransom. Another US healthcare provider, Ascension, also suffered a disruptive cyber-attack later that year.