Romanian Hospitals Go Offline in Nationwide Cyberattack – A Pen‑and‑Paper Rescue

Tue Jun 23 2026 18:44:48 GMT+0000 (Coordinated Universal Time)

Hundreds of Romanian hospitals shut down by ransomware, forcing staff to revert to paper as cyber‑security teams isolate and restore systems.

In February 2024 a ransomware strain known as BackMyData broke into a widespread medical software used by almost every Romanian hospital, forcing more than 100 facilities to cut off Internet access and switch to manual processes. Staff scrambled to keep patients safe, using pen and paper for registration, lab results and medication orders, while national cyber‑security teams worked overnight to flash the hospitals back online. The attack caused no reported deaths, but the process of re‑entering paper notes would take weeks, underscoring the importance of regular backups. The incident highlights the growing threat to healthcare IT and the need for robust contingency plans.

Facing a nation‑wide ransomware onslaught, Romanian hospitals had to ditch their digital systems and turn to paper – a high‑stakes, high‑pressure plan that kept patients safe.

The cyber‑attack began on 10 February 2024 when hackers infiltrated a popular medical system called Hippocrates, used by doctors, nurses and administrators to manage everything from admissions to pharmacy inventory. The malicious code, known as BackMyData, scrambled files and demanded €160,000 in bitcoin.

A national decision was made to pull more than 100 hospitals offline, cutting them from the Internet and exposing the fragility of the digital fabric that keeps modern medicine running. “Disconnect from the internet, now,” the national cyber‑security centre instructed hospital chiefs – a move that bought time, but left staff with no email or electronic medical record system.

The fallout forced clinicians to improvise. Doctors and nurses started writing patient names, lab requests and medication orders by hand, and some used Excel sheets on isolated laptop machines to record data. In Buzău Hospital, surgeon Oana Goidescu described the chaos: “For each patient we normally request lab tests, radiology, medicines and supplies. All of that was gone.”

While IT teams and the national cyber‑security centre worked overnight to isolate malware and restore backups, a public campaign urged patients to delay non‑essential visits. Grievous frustration from waiting‑room crowds trailed the message – staff was not at fault for a compromised system.

Within five days, most hospitals were back online with additional safeguards. The response was praised for preventing any serious harm or fatalities, but some data written on paper was lost permanently, highlighting the necessity of regular, secure backups.

The incident serves as a warning: as health services become more digitised, their vulnerability to ransomware grows. Experts say the only way to safeguard life‑saving care is a mix of robust cyber‑defense, careful backup procedures and staff training for unforeseen outages.