Romanian Hospitals Switch to Pen and Paper to Halt Mass Ransomware Attack

Tue Jun 23 2026 04:41:08 GMT+0000 (Coordinated Universal Time)

When a ransomware outbreak knocked out 100 hospitals, staff relied on pen and paper to keep patient care safe.

In February 2024 a ransomware strain targeted Romania’s national health system, disabling the Hippocrates software used by more than 100 hospitals. The national cyber‑security centre ordered the hospitals to disconnect from the internet, forcing medical teams to revert to paper records and manual procedures. IT specialists worked overnight to remove the BackMyData malware and restore systems from recent backups. Within five days most hospitals regained online capability, with only a handful of data losses. The incident highlights the growing risk to healthcare infrastructure and serves as a case study for crisis response planning worldwide.

Romanian Hospitals Switch to Pen and Paper to Halt Mass Ransomware Attack

In early February 2024 a coordinated cyber‑attack disabled the Hippocrates electronic health system used by over a hundred Romanian hospitals. The attackers embedded a ransomware strain named BackMyData into a popular medical software platform built by the Bucharest‑based firm RSC.

Cyber‑security officials at the national DNSC monitored the spread, but as the malware reached the Buzău and Piteşti hospitals they had no choice but to cut the facilities off from the internet. The command to “disconnect from the internet, now” prevented the ransomware from exploiting further network connections and saved patient data from being encrypted.

With computers offline, doctors and nurses had to improvise: patient registration was moved to paper forms, laboratory results came on printed sheets, and Excel spreadsheets tracked medication orders. In city hospitals, staff explained that they were not to blame for delays, but were carefully documenting procedures manually to preserve continuity of care.

The botched network was patched overnight by IT specialists who worked with the Hippocrates makers to isolate infected systems. A recovery plan that heavily relied on recent backups meant that most hospitals were back online within five days and no patients died due to the outage, although some data had to be manually re‑entered.

The incident prompted public messaging urging people to avoid non‑essential visits and was used by the DNSC to explain the rationale behind refusing the €160,000 ransom demand. It also spurred a broader discussion about the vulnerability of healthcare infrastructure, noting similar hacks on UK NHS labs and US health‑care providers such as Change Healthcare and Ascension.

Experts say that the more digitised a system becomes, the greater the potential impact of an attack. The case has been cited as a vital lesson for disaster‑planning and crisis response, highlighting that paper backups and clear communication can keep life‑saving services running, even when digital systems fail.