Buzău Hospital

Summary

During a widespread ransomware campaign targeting the Hippocrates medical software used across Romania, attackers infected dozens of hospital networks with the BackMyData strain, prompting the national cyber‑security centre to order more than 100 facilities to disconnect from the internet. At Buzău Hospital, surgeons described the loss of electronic records for patient admissions, tests, medications and payroll, forcing staff to revert to paper‑based workflows and improvise with laboratory printouts and offline spreadsheets while IT teams worked to restore systems from backups. The response kept critical care functioning, and after a short offline period most hospitals returned to operation with no reported fatalities or serious patient harm.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In February 2024 a ransomware strain known as BackMyData infected the Hippocrates medical software used by hospitals across Romania after attackers breached the Bucharest‑based firm RSC that developed the system. Surgeon Oana Goidescu was on shift at Buzău Hospital, located 120 kilometres north‑east of Bucharest, when the alert arrived that the Hippocrates network had been compromised and that IT records for patients—including lab test requests, radiology orders, medication lists and supply needs—had become inaccessible. The infection quickly spread, and cyber‑investigators later confirmed that 26 hospitals nationwide had been hit with the BackMyData ransomware, which scrambled files into gibberish and demanded payment in bitcoin. Staff at Buzău Hospital reported that the loss of the digital system meant they could no longer access electronic patient charts, pharmacy logistics or payroll functions through Hippocrates, forcing an immediate shift to manual processes.

In response, the national cyber‑security centre ordered all affected hospitals to disconnect from the internet to halt the ransomware’s spread, a directive that Buzău Hospital followed alongside more than 100 other facilities. Medical personnel switched to pen and paper, asking the laboratory to provide test results on printed sheets and using Excel and other offline tools to record patient admissions, treatments and medication orders. Surgeon Goidescu described how the team developed an offline method to register every patient despite the absence of the electronic system, while waiting rooms filled with patients who grew frustrated and sometimes directed anger at staff. Public messaging urged people to seek care only when necessary, and officials emphasized that hospitals should not contact the attackers or pay the ransom. IT teams at Buzău Hospital and elsewhere began restoring systems from recent backups, and within five days most hospitals, including Buzău, were back online and operating close to normal levels, with no reported deaths or serious harm to patients.

The aftermath required weeks of manual data entry to transfer the information recorded on paper during the outage back into the restored Hippocrates system, and some data generated during the interruption was lost forever. Police have not commented on their investigation into the perpetrators, though a ransomware group linked to BackMyData had its website taken down in an international operation the previous year, resulting in the arrest of four individuals outside Russia. The incident at Buzău Hospital exemplified the broader impact of the February 2024 cyber‑attack on Romanian healthcare, illustrating how a disruption to a widely used medical software forced clinicians to rely on analogue workflows, strained patient‑staff interactions, and prompted a coordinated national response that prioritized containment, communication and recovery without yielding to extortion demands.

Sources

Sources available to members: 1 source.