Computer technology has arrived to make our lives easier. In the health field, for example, hospitals are increasingly interconnected. Doctors in many countries around the world have access to electronic medical records and patients to paperless prescriptions. All of this can be fantastic, as long as it works well, of course.
Romania experienced it in February 2024, when part of its health system was caught in a virus attack. ransomware which affected the Hipocrate platform used by hospitals throughout the country. Two years later, a reconstruction of the BBC It allows us to better understand what happened, how many hospitals were really infected and how the crisis was contained.
The problem was especially delicate because Hippocrates was integrated into very different tasks of daily hospital life. The platform was used to register patients, order tests, view results, manage medications, and organize supplies. In practice, its fall left many centers without one of their main coordination tools.
The ransomware variant identified was BackMyData. As usually happens in this type of attacks, the files were encrypted, renamed and unusable for system administrators. There was talk of a ransom of 3.5 bitcoins, about 175,000 euros at the exchange rate at the time, in exchange for the supposed key to recover the information.
As new notices came in from hospitals, Romania’s National Cyber Security Directorate, the DNSC, made a drastic decision: ordering more than 100 hospitals to they will disconnect from the network. The measure left them without digital tools, but it allowed them to isolate the problem and gain time.
Over time, the photography of the incident has become more refined. The number of hospitals directly infected by BackMyData was 26. The operational impact, however, was much greater: more than 100 hospitals were left offline or without normal access to their digital services.
Inside the hospitals, the response was much more earthly. Some doctors asked the lab to deliver results on paper, others turned to offline spreadsheets, and many went back to register patients by hand. It was not a metaphor: for several days, part of the Romanian healthcare functioned with analogue tools.
Romania chose not to pay the ransom and focused recovery on available backups. The strategy allowed operations to be recovered, at least essentially. According to updated information, most hospitals returned to almost normal operation in about five days.
While there were no deaths or serious injuries to patients, the outage left work pending for weeks. All the information written down on paper had to re-enter the systems and some data was lost forever.
Romanian authorities have not publicly attributed the attack to a specific group. There was later an international operation against a gang related to the BackMyData ecosystem, with four Russian citizens arrested outside Russia, but the BBC does not present it as a direct resolution of the case.
Those days left an image that is difficult for many to forget: modern hospitals, useless screens and doctors doing something as old as writing to continue providing care. This case, however, also showed that backups and recovery plans are essential in the interconnected world we live in.
Images | Pixabay | Tima Miroshnichenko | Miguel Ausejo
GIPHY App Key not set. Please check settings