In brief
In February 2024 a ransomware strain called BackMyData crippled over 100 Romanian hospitals that use the Hippocrates medical software. The national cyber‑security centre ordered all hospitals to disconnect from the internet, stopping the malware but also banning electronic records. Medical teams improvised with pen‑and‑paper, sharing lab results on sheets and using spreadsheets to keep care on track. Within five days most services were restored, no deaths reported, and the incident highlighted both the risks of digital dependency and the resilience of frontline staff.
The Digital Shutdown
In mid‑February a ransomware bot nicknamed BackMyData spread through the Hippocrates medical software used by >100 Romanian hospitals. The malware scrambled files and demanded €160,000 in bitcoin.
Faced with a national threat, the cyber‑security centre ordered every hospital to cut off internet access. That move stopped the attackers but forced a pivot to analog work.
Hands‑On Solutions
Doctors, nurses and IT teams created paper‑based workflows: patient charts were handwritten, lab results were printed on paper and Excel sheets were used offline. "We had to register every patient on paper," said Vlad Paic of Carol Davila Hospital.
Once the isolation period ended, infected systems were cleaned, backups restored and hospitals went back online. Five days later services were largely normal with no major patient harm.
Lessons Learned
- Regular, recent backups reduce data loss.
- Off‑line readiness can keep care continuity under cyber crisis.
- Hospitals must not pay ransoms; public warnings helped keep a no‑payment stance.
The attack underscores how a single digital vulnerability can ripple across a nation’s health system and how frontline staff can be the real heroes in a tech‑driven crisis.
