BackMyData ransomware hit Romanian hospitals via Hippocrates software supplier

A BackMyData ransomware attack disrupted Romania's healthcare sector after attackers breached Bucharest-based software firm RSC and compromised its widely used Hippocrates hospital management platform. Romanian authorities said more than 100 hospitals were told to disconnect from the internet to contain the spread, while 26 hospitals were confirmed as directly infected. Because Hippocrates supported admissions, lab tests, radiology, medicines, supplies, payroll, pharmacy logistics, and test results, clinicians and administrators were forced to abandon digital systems and return to pen-and-paper and other offline workflows.

The attackers encrypted files and demanded roughly €160,000 in Bitcoin, but Romanian officials instructed hospitals not to negotiate or pay. Most affected systems were restored within about five days using secure backups, though some data was permanently lost. The response by hospital staff, IT teams, and Romania’s national cyber authorities has since been cited as a notable example of healthcare incident response, emphasizing the value of network isolation, resilient backups, crisis communications, and rehearsed continuity plans.