Loading story…
A BackMyData ransomware attack disrupted Romania's healthcare sector after attackers breached Bucharest-based software firm RSC and compromised its widely used Hippocrates hospital management platform. Romanian authorities said more than 100 hospitals were told to disconnect from the internet to contain the spread, while 26 hospitals were confirmed as directly infected. Because Hippocrates supported admissions, lab tests, radiology, medicines, supplies, payroll, pharmacy logistics, and test results, clinicians and administrators were forced to abandon digital systems and return to pen-and-paper and other offline workflows.
The attackers encrypted files and demanded roughly €160,000 in Bitcoin, but Romanian officials instructed hospitals not to negotiate or pay. Most affected systems were restored within about five days using secure backups, though some data was permanently lost. The response by hospital staff, IT teams, and Romania’s national cyber authorities has since been cited as a notable example of healthcare incident response, emphasizing the value of network isolation, resilient backups, crisis communications, and rehearsed continuity plans.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Romanian authorities instructed affected hospitals not to negotiate with or pay the attackers during the incident response. The guidance accompanied broader containment and recovery efforts across the healthcare sector.
Investigators later determined that 26 hospitals were directly infected with BackMyData ransomware during the Romania healthcare-sector incident. The malware encrypted files and the attackers demanded €160,000 in Bitcoin.
Most affected systems were restored within five days using secure backups, though some data was permanently lost. The recovery ended several days of paper-based operations at impacted hospitals.
During the February 2024 incident, Romania’s National Directorate for Cyber Security ordered more than 100 hospitals to disconnect from the internet to limit the spread of the attack. The move forced medical staff to switch to paper-based and offline workflows while investigators worked on containment.
On 2024-02-10, attackers breached Bucharest-based software firm RSC and compromised its Hippocrates hospital management system, triggering a ransomware incident that disrupted hospitals across Romania. The attackers deployed the BackMyData ransomware strain, encrypting files and demanding payment in bitcoin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcebbc.co.uk
Open sourcebbc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware attacks have repeatedly crippled hospital operations, forcing providers to divert care, lose access to critical systems, and in some cases pay attackers to recover. At Hollywood Presbyterian Medical Center in Los Angeles, malware encrypted files and disrupted the hospital's computer network, prompting executives to pay about **$17,000 in bitcoin** after attackers reportedly reduced an initial demand of **$3.4 million**. The outage interfered with administrative functions and highlighted how cyberattacks on healthcare can create direct patient-safety risks. The threat later scaled across national healthcare systems. The **WannaCry** outbreak spread to nearly 100 countries and severely impacted the UK's **NHS**, knocking hospitals and clinics offline and disrupting appointments and treatment. In Romania, a ransomware attack on a healthcare IT platform left multiple hospitals offline, underscoring how attacks on shared digital infrastructure can cascade across many facilities at once and paralyze care delivery well beyond a single organization.
Jun 29, 2026
Medibank said attackers accessed personal data belonging to all of its customers and some authorized representatives, affecting about **9.7 million** current and former customers. The Australian health insurer said the compromised information included identifying details and health claims data for roughly **480,000** customers, and warned that all accessed data may have been stolen. Medibank later said it would **not pay the ransom**, citing expert advice that payment would not ensure the return of data or prevent its publication, while Australian officials backed the decision and warned that ransom payments fuel further extortion. In Romania, hospitals were forced offline after a ransomware attack hit a healthcare IT platform used by multiple medical facilities, disrupting operations across the country. Reporting indicated the crisis was linked to a **third-party incident**, underscoring how attacks on shared service providers can cascade across healthcare organizations. Together, the incidents highlight how cybercriminals are targeting healthcare entities through both direct intrusions and attacks on critical external platforms, exposing sensitive patient data and interrupting care delivery.
Jun 29, 2026
Ireland’s Health Service Executive (HSE) was hit by a major **Conti ransomware** attack that forced the shutdown of national health IT systems, disrupted hospital clinics, maternity services, radiology, GP referrals, and parts of Covid-19 testing and contact tracing, while emergency care and the vaccination programme continued. Irish officials said the attack began early on a Friday morning, described it as one of the most serious cybercrime incidents ever faced by the state, and confirmed the government would **not pay** a bitcoin ransom. Investigators also examined related hostile activity, including an attempted intrusion at the Department of Health and earlier distributed denial-of-service activity, while Gardaí, the National Cyber Security Centre, Defence Forces, Europol, and outside cybersecurity experts joined the response. The attackers were reported to have demanded about **$20 million** and claimed to have stolen roughly **700 GB** of data, raising fears that patient and employee information could be leaked on dark-web extortion sites. Recovery was expected to take weeks as the HSE rebuilt systems and shifted many services to manual processes, while the health service sought court injunctions to restrain the sharing of hacked data. The financial fallout later climbed to about **$600 million**, and the long tail of the breach continued years later, with the HSE offering compensation to some victims affected by the system-wide cyberattack.
Jun 29, 2026