From Digital to Handwritten: Romania’s Hospital Cyber‑Outbreak

Thu Jul 16 2026 01:35:51 GMT+0000 (Coordinated Universal Time)

When an attack crippled Romanian hospitals, doctors turned to paper to keep patients safe, revealing crisis response lessons for cyber‑security.

In February 2024 a ransomware strain hijacked a nationwide medical software, pulling 100 hospitals offline. The national cyber‑security centre ordered immediate internet disconnection, forcing clinicians to revert to paper protocols. While IT teams combed the infected networks, doctors and nurses maintained care with manual records and local work‑arounds. The episode highlighted the vulnerability of digitised health services and underscored the necessity of robust backups and real‑time crisis communication.

One after another the calls came in from hospitals; criminals were infecting computer networks in a mass hack that was putting countless lives at risk.

At Bucharest's national cyber-security centre they watched helplessly as the hackers spread across Romania through a popular piece of medical software. Cyber‑chief Dan Cimpean had a tough decision to make – the only option was to cut off 100 hospitals from the internet.

The order went out to all hospitals: “Disconnect from the internet, now.” By doing so, the hackers were stopped in their tracks, buying critical time for IT teams to assess the damage. The cost, however, was a sudden loss of all connected devices, email, web browsers and pharmacy, laboratory, and payroll systems.

Medical staff improvised work‑arounds, switching to pen and paper to register patients, request lab tests and medication, and keep receiving care while national responders worked to isolate the ransomware. The response over four days was praised and is now a test case for disaster planners worldwide.

The named ransomware, BackMyData, demanded €160,000 in bitcoin – a ransom the national decision was not to pay. Most hospitals had recent backups, which allowed most to restore systems within five days. Nevertheless, the loss of data written on paper during the outage cannot be fully recovered.

The attack underscored a key risk: the more technology you have, the greater the risk. Reuters has highlighted other moments – the UK NHS hack that caused a patient’s death and the US Change Healthcare ransom – that illustrate why hospitals are prime targets for cyber‑criminals.

*Surgeon Dr. Oana Goidescu on shift when her hospital was hit by the cyber attack.*

The national cybersecurity centre used media outreach to calm the public: patients were urged to avoid non‑urgent hospital visits until the systems were restored. The messaging also dissuaded hospitals from negotiating with the attackers, reinforcing that paying a ransom offers no guaranteed return.

Authorities remain investigating the perpetrators. However, more than 90% of the infected systems were cleared by the end of the week, and no serious harm to patients was reported.

On 23 June, the BBC World Service launched a Romanian-language platform, BBC News Romania, to deliver trusted journalism across Romania, Moldova, and wider Europe.