Romanian Hospitals Hit by Massive Ransomware Attack, Forcing Return to Pen and Paper On 10 February 2024, a ransomware attack crippled 100 hospitals across Romania, disrupting critical medical systems and forcing staff to revert to pen-and-paper record-keeping. The attack targeted Hippocrates, a widely used medical software system developed by Bucharest-based firm RSC, which manages patient records, lab results, pharmacy logistics, and payroll. The BackMyData ransomware strain encrypted files, rendering them unusable, and demanded a €160,000 (£138,000) bitcoin ransom. Hospitals reported the first signs of infection on Sunday morning, with Pitești Children’s Hospital among the earliest affected. Surgeon Oana Goidescu, on shift at Buzău Hospital, described the chaos: "All lab tests, radiology requests, and medication records were gone it wasn’t just a list of patients." With systems offline, IT teams and the National Cyber Security Directorate (DNSC) scrambled to contain the breach. Authorities issued an emergency order to disconnect hospitals from the internet, halting the malware’s spread. Cybersecurity firm Bitdefender noted that hospitals are prime targets for ransomware gangs due to their critical services and high-pressure environments, increasing the likelihood of payment. Despite the disruption, no deaths or serious patient harm were reported. Staff at Carol Davila Hospital in Bucharest developed offline workarounds, including Excel spreadsheets and paper records, to maintain care. Vlad Paic, a hospital representative, credited Romania’s recent digital transition for easing the shift back to analog methods. By 15 February, most hospitals had restored systems from backups and resumed near-normal operations, though some data was permanently lost. The DNSC refused to pay the ransom, a decision praised by cybersecurity experts. Dan Cimpean, head of Romania’s Cyber-Security Directorate, emphasized the growing risks of digital dependency, stating, "The more technology you have, the greater the risk." The attack mirrored global trends, including a $22 million ransom payment by U.S. firm Change Healthcare in a separate incident. While Romanian authorities have not identified the attackers, four Russians were later arrested outside Russia in connection with other healthcare cybercrimes. The FBI has since declared healthcare the most targeted sector in critical infrastructure. The response rapid containment, media coordination, and backup reliance has become a case study for disaster planners worldwide. However, the incident underscored vulnerabilities in medical software supply chains, with experts warning that such attacks are increasing in frequency and severity.