Over 20 hospitals in Bucharest have reportedly been impacted by a ransomware attack after cybercriminals targeted an IT service provider. As a consequence medical staff have been forced to use pen-and-paper rather than computer systems.
Romania’s National Cybersecurity Directorate (DNSC) said in a statement that the attackers encrypted hospital data using the Backmydata ransomware – a variant of Phobos.
The DNSC advises not to contact the IT teams at affected hospitals “so they can focus on restoring IT services and data! This is the priority at the moment.”
The attackers are understood to have demanded a ransom of 3.5 Bitcoin (at the time of writing that’s just under US $175,000). The DNSC has advised affected organisations not to pay the ransom, and not to contact the extortionists.
The affected hospitals all used the Hipocrate IT platform, developed by Romanian software company RSC to manage patients’ data and track their progress from initial admission to discharge.
Affected hospitals include:
- Azuga Orthopaedics and Traumatology Hospital
- Băicoi City Hospital
- Buzău County Emergency Hospital
- C.F. Clinical Hospital no. 2 Bucharest
- Colțea Clinical Hospital
- Emergency County Hospital “Dr. Constantin Opriș” Baia Mare
- Emergency Hospital for Plastic, Reconstructive and Burn Surgery Bucharest
- Fundeni Clinical Institute
- Hospital for Chronic Diseases Sf. Luca
- Institute of Cardiovascular Diseases Timișoara
- Medgidia Municipal Hospital
- Medical Centre MALP SRL Moinești
- Military Emergency Hospital “Dr. Alexandru Gafencu” Constanta
- Oncological Institute “Prof. Dr. Al. Trestioreanu” Institute Bucharest (IOB)
- Pitești Emergency County Hospital
- Regional Institute of Oncology Iasi (IRO Iasi)
- Sighetu Marmației Municipal Hospital
- Slobozia County Emergency Hospital
- St. Apostol Andrei Emergency County Hospital Constanta
- Târgoviște County Emergency Hospital
The DNSC reports that 79 more hospitals using Hipocrate have disconnected from the internet in the wake of the attack. The attack was first spotted on Saturday, February 10 at the Pitești Paediatric Hospital.
According to the DNSC, most affected hospitals have backups of the data encrypted by the ransomware, which should aid recovery. But in at least one case, the most recent backup was saved 12 days ago.
Hat-tip: Thanks to reader Gheorghe for his assistance with this article.
