Romania’s cyber security agency says says cyber attackers have sent a ransom demand of some 157,000 euros after they took down healthcare management system at more than two dozen hospitals nationwide.
The name of the group claiming the attack is not mentioned in the ransom note, just an email address.
Some 26 medical units have been affected but there is currently no evidence of data theft.
The attack left major hospitals offline and doctors having to write prescriptions. The ransomware attack affected various hospitals across Romania, including regional and cancer treatment centers.
The Hipocrate Information System (HIS) used by hospitals to manage medical activity and patient data was first targeted over the weekend and is now offline after its database was encrypted.
„After 400 computers and servers were shut down, we worked mostly on paper,” IRO Iasi manager Mirela Grosu told Agerpres.
„During the night of 11-12 February 2024, a massive ransomware cyber-attack targeted the production servers running the HIS information system. As a result of the attack, the system is down, files and databases are encrypted,” the health ministry said on Monday.
IT specialists, including cybersecurity experts from the National Cyber Security Directorate (DNSC) are investigating the incident.
DNSC says the attackers used Backmydata ransomware to encrypt the hospitals’ data, a ransomware variant from the Phobos family.
The list of impacted hospitals shared by the DNSC includes:
- Pediatric Hospital Pitesti
- Buzău County Emergency Hospital
- Slobozia County Emergency Hospital
- „Sf. Apostol Andrei” Emergency County Clinical Hospital Constanta
- Pitești County Emergency Hospital
- Military Emergency Hospital „Dr. Alexandru Gafencu” Constanta
- Institute of Cardiovascular Diseases Timișoara
- Emergency County Hospital „Dr. Constantin Opriș” Baia Mare
- Sighetu Marmației Municipal Hospital
- Târgoviște County Emergency Hospital
- Colțea Clinical Hospital
- Medgidia Municipal Hospital
- Fundeni Clinical Institute
- Oncological Institute „Prof. Dr. Al. Trestioreanu” Institute Bucharest (IOB)
- Regional Institute of Oncology Iasi (IRO Iasi)
- Azuga Orthopaedics and Traumatology Hospital
- Băicoi City Hospital
- Emergency Hospital for Plastic, Reconstructive and Burn Surgery Bucharest
- Hospital for Chronic Diseases Sf. Luca
- C.F. Clinical Hospital no. 2 Bucharest
- Medical Centre MALP SRL Moinești
- Institute of Phonoaudiology and ENT Functional Surgery „Prof. Dr. D. Hociotă”, Bucharest, Romania
- Brad Pneumonology Sanatorium, Hunedoara
- Hospital of Pneumonology Rosiorii de Vede
- Băicoi City Hospital
- Sante Clinic Calarasi
- Institute of Phonoaudiology and ENT Functional Surgery „Prof. Dr. D. Hociotă”, Bucharest, Romania
- Brad Pneumonology Sanatorium, Hunedoara
- Hospital of Pneumonology Rosiorii de Vede
- Băicoi City Hospital
- Sante Clinic Calarasi
PM’s ID document leaked in cyber attack on Romanian Parliament
