Services in 18 hospitals in Romania impacted by ransomware cyberattack

Update: The hackers behind the cyberattack that disrupted the activity of multiple hospitals in Romania demanded a ransom of 3.5 BTC, or EUR 157,000. Romania’s National Directorate for Cyber Security recommended hospitals and authorities avoid contact with the attackers and refuse to pay.

According to the DNSC, the attackers' message does not specify a group name claiming the attack, but only an email address. The institution also said cyberattacks directed at four other healthcare units have been confirmed, but there is no indication of data exfiltration.

Hospitals using the Hipocrate platform, whether affected or not, have received from the DNSC a series of recommendations for properly managing the situation. Among these recommendations are the isolation of affected systems from the rest of the network and the avoidance of shutting down affected equipment so as to preserve evidence. The DNSC also advised restoring affected systems with the help of backups that are secure.

Twenty-one hospitals in Romania have been affected by the cyber attack so far. Prosecutors from DIICOT have already initiated an investigation into this case.

Initial story: Eighteen hospitals in Romania cannot report medical services, forcing patients to wait in emergency rooms after a ransomware cyberattack occurred on Monday morning, February 12, targeting a service provider for several health units.

"Several hospitals are affected by the attack. At this moment, a team of DNSC specialists has been dispatched to the scene to investigate the cyber incident," the National Directorate for Cybersecurity said.

DNSC recommends that the IT teams of the hospitals should not be contacted, so they can focus on restoring IT services and data, which is a priority.

Health minister Alexandru Rafila initially stated that between 15 and 20 hospitals in the country and in Bucharest are experiencing problems using the Hipocrate computer system.

"It's true. There are several hospitals facing issues with the use of an important computer program in hospital operations - it's called Hiprocrate. We don't know exactly how many hospitals are affected at the moment. We don't have the information, but we are working together with the National Cybersecurity Center to elucidate the causes and remedy them," the minister said, according to