Romania stopped a major cyber-attack on its healthcare system by disconnecting more than 100 hospitals from the internet. The emergency action prevented hackers from spreading ransomware and disrupting more medical facilities.

The attack started in February 2024 after cybercriminals breached software used by hospitals across Romania. The BackMyData ransomware infected systems connected to the widely used Hippocrates medical platform. The malware disrupted patient records, prescriptions, laboratory requests, and other key services.

Romania’s National Cyber Security Directorate quickly ordered hospitals to go offline. The decision stopped the attack from spreading further. However, doctors and nurses lost access to digital records, emails, and online tools.

Medical staff switched to paper records to keep services running. They registered patients manually and received laboratory results on paper. Some hospitals used offline computer tools to support daily operations.

Investigators later confirmed that the ransomware infected 26 hospitals. Authorities worked with the software provider to remove the malware and strengthen security before reconnecting systems.

Romania also launched a public information campaign during the crisis. Officials urged people to avoid unnecessary hospital visits and warned hospitals not to contact the attackers. The hackers demanded €160,000 in bitcoin, but authorities refused to pay.

Most hospitals returned to normal operations within five days. Officials reported no deaths or serious patient harm linked to the attack. Staff then spent weeks transferring paper records back into digital systems.

The Romanian cyber-attack highlights the growing threat facing healthcare systems worldwide. Most hospitals returned to normal operations within five days, with no reported deaths or serious patient harm.

Experts say strong cybersecurity and regular data backups are essential to protect healthcare services from future attacks. However, staff spent weeks transferring information recorded on paper back into digital systems, and some data was permanently lost.

Cybersecurity experts say healthcare facilities remain attractive targets because disruptions to critical services increase pressure on victims to pay. The incident highlights the importance of strong cyber defenses, regular data backups, and emergency plans for maintaining essential services during digital outages.