In February 2024, Romania faced an unprecedented cyber-attack that hit its healthcare system hard. This attack, recognized as one of the most challenging in global healthcare history, forced more than 100 hospitals to disconnect from digital systems and return to pen and paper for four critical days.
The ransomware, known as BackMyData, infiltrated healthcare networks through widely-utilized medical software called Hippocrates. In the wake of this assault, the Romanian national cyber-security center (DNSC) directed all affected hospitals to completely unplug from the internet. This measure helped to prevent further penetration by cybercriminals, but it also required hospitals to fully depend on manual processes for essential services, such as patient management, processing laboratory results, and ordering medications.
Hospital IT teams, while tirelessly battling to diagnose the infection and reconnect systems, were supported by healthcare staff who quickly adapted to offline operations. Manual record keeping replaced digital systems for patient registrations and laboratory tests, and staff relied on offline tools like Excel to maintain vital operations. Interestingly, due to Romania’s recent transition to digital technologies, many staff members retained a familiarity with traditional paper-based methods, which aided this shift back to basics.
Throughout this period, media played a pivotal role by advising the public to minimize hospital visits unless absolutely necessary, thus alleviating extra pressure on the already strained facilities. Despite these efforts, patients experienced inevitable frustration due to disruptions and delays, sometimes resulting in tensions with hospital staff who were operating under significant stress.
The international community gleaned several critical lessons from this cyber incident. Primarily, it emphasized the importance of regular data backups in resuming normal operations swiftly without succumbing to ransom demands. Romania’s steadfast refusal to engage with the attackers also set a strong example, deterring future cybercrimes by not incentivizing such actions.
Ultimately, Romania’s handling of this cyber-attack is a powerful example of resilience in healthcare cybersecurity. It reinforces the necessity of having robust crisis response strategies, effective data recovery protocols, and proactive public communication plans. As cyber threats against critical infrastructure become more frequent and sophisticated, these lessons are crucial to maintaining functioning and trust in essential services.