Pen‑and‑Paper Rally: 100 Romanian Hospitals Outsmart Ransomware

Tue Jun 23 2026 19:21:37 GMT+0000 (Coordinated Universal Time)

When a ransomware attack crippled Romania’s health network, hospitals went offline and clinicians rewrote care protocols with handwritten notes.

In February 2024 a ransomware virus called BackMyData infiltrated a popular Romanian medical software, forcing 100 hospitals to shut their online services. With machines down, doctors and nurses abandoned digital records for handwritten sheets, improvising protocols to keep patients safe. Cyber‑security officials at the DNSC cut the hospitals off from the internet, buying time to isolate the threat and restore systems from recent backups. The swift transition to paper proved that even in a high‑tech sector, resilience can rely on simple, analog practices. The event has become a case study for national emergency planners worldwide.

Pen‑and‑Paper Rally: 100 Romanian Hospitals Outsmart Ransomware

Surgeon Oana Goidescu on shift at Buzău Hospital in blue scrubs — Surgeon Oana Goidescu was on shift when her hospital was hit by the cyber attack.

A cyber‑security team at Bucharest’s national centre watched a ransomware virus, BackMyData, quietly spread across the country via a widely used medical software called “Hippocrates”. The virus encrypted patients’ records, lab results and pharmacy orders, demanding €160,000 in bitcoin.

Faced with an immediate risk to life, cyber‑chief Dan Cimpean ordered more than 100 hospitals to cut off their internet connections. The move bought the country time; it stopped the attackers in their tracks and allowed IT teams to begin isolating the infection.

Without digital systems, clinicians had to revert to the basics. Doctors wrote patient details by hand, asked laboratories for paper results, and used spreadsheets copied offline to keep track of medication and test orders. Hospital staff praised the quick improvisation, noting that the shift to pen and paper was smoother than expected because the country’s health network had only recently gone fully digitised.

The crisis also highlighted the importance of public messaging. The national cyber‑security centre urged patients to avoid non‑urgent visits, warned hospitals against paying the ransom, and communicated live updates that helped keep the public calm.

By the end of five days most hospitals were back online, largely because they had recent backup copies. Some handwritten data could not be re‑entered digitally, meaning a small amount of information was lost forever. No patients died as a result of the outage, but the event has become a model for how to handle mass cyber attacks on critical infrastructure.

Experts point out that the more digitised a system, the greater the risk. A similar incident in the UK and another in the US show that ransomware targeting health services continues to grow, with criminal groups hoping to force payments by disrupting life‑saving services.