In brief
In February 2024 a coordinated ransomware assault hit Romania’s healthcare network, crippling the widely used Hippocrates system. The national cyber‑security center’s emergency directive forced over 100 hospitals to disconnect from the internet, compelling doctors and nurses to rely on handwritten notes and paper logs to document treatments. On the ground at Buzău Hospital, surgeons like Oana Goidescu explained how the loss of electronic lab, radiology and medication orders meant “all of that was gone.” Despite the chaos, the crisis spurred innovative workarounds: staff printed lab results, used spreadsheets offline, and maintained patient care until backups could restore digital records. Within five days, most hospitals returned online, though the manual records produced during the outage created a backlog for digitization and a small amount of data could not be recovered. The incident underscores the risk posed by the digitalisation of critical services and the value of robust backup strategies, while also highlighting how communities can adapt and maintain care in the face of technological disruption.
On 10 February 2024, Romanian hospital networks went dark when a ransomware gang levered a backdoor into the Hippocrates medical software system, infecting dozens of clinics and forcing them to shut down their servers for safety.
The Decision‑Making Division of Romania’s National Cyber‑Security Directorate (DNSC) issued a single command that went from the capital to the farthest rural hospital: “Disconnect all systems and go offline.” The response was swift and ordered every computerized workstation to isolate itself from the internet, turning the country’s digital health backbone into a paper‑only lifeline for the next few days.
At Buzău Hospital, Surgeon Oana Goidescu described the shock: “The electronic record was a living ledger—patients, lab tests, prescriptions, supplies—when the system went blank, that ledger vanished.” Her colleagues had to improvise a manual registration process in a high‑pressure environment, moving from electronic charts to handwritten notes, and even printing lab results to keep the treatment chain moving.
The sudden transition back to analogue helped prevent accidents that could arise from stalled electronic inventories. In many facilities, neurologists and radiographers relied on paper outlines and manual checklists to coordinate patient flow. The hospitals’ IT teams joined forces with the software makers to determine the exact number of infected sites—26 were confirmed—and to purge malicious backdoors from the network.
Once the ransomware, “BackMyData,” had been removed, the remaining uninfected hospitals were brought online, layered with stronger firewall policies and surveillance of external connections. The national media was also actively used to advise the public: “If you need to visit a hospital, only do so when it’s medically essential” and “Never contact the attackers or pay the ransom.” These messages managed to keep waiting rooms from becoming overwhelmed, though some patients still expressed frustration.
The final phase was the manual digitisation of paper records—a process that could take several weeks to fully integrate, with some information irretrievably lost. Thanks to a recent history of periodic backups, most hospitals could restore their core datasets within five days, and no serious harm to patients was reported.
This daring move underscores a broader lesson: the more an organisation relies on digital solutions, the greater its vulnerability to cyber‑attacks. The incident is a stark reminder of the necessity for redundancy, robust backup routines, and community‑driven resilience—an echo of traditional wisdom that local and indigenous practices have long championed: when technology falters, collective ingenuity can keep life functioning.
