Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
AIIMS Delhi cyber attack, 2022
On 23 November 2022 the servers of the All India Institute of Medical Sciences (AIIMS) in New Delhi went down in a cyber attack that some reports called ransomware.
In short
On 23 November 2022 the servers of the All India Institute of Medical Sciences (AIIMS) in New Delhi went down in a cyber attack that some reports called ransomware. India's Minister of State for Electronics and IT told the Rajya Sabha that unknown threat actors compromised servers because of improper network segmentation. About 1.3 terabytes of data was encrypted, and hospital work ran in manual mode until systems were restored from backup.
What happened
The servers at AIIMS in New Delhi stopped working in late November 2022. A PTI report says the institute allegedly faced a cyber attack on 23 November 2022 that paralyzed its servers. Business Today wrote that the breach was discovered on a Wednesday morning. On 25 November the Intelligence Fusion and Strategic Operations (IFSO) unit of the Delhi Police registered a case of extortion and cyber terrorism.
While the server was down, patient care in the emergency, outpatient, inpatient and laboratory wings was managed manually, according to Business Today. The Minister of State for Health later told the Lok Sabha that day-to-day operations, surgeries and record keeping were done in manual mode after the attack. By 28 November the server had been out of order for six days.
On 16 December 2022 the government answered in Parliament. The Minister of State for Electronics and IT said servers in the AIIMS network were compromised by unknown threat actors because of improper network segmentation. He said five servers were affected and approximately 1.3 terabytes of data was encrypted. The Minister of State for Health said five physical servers hosting the National Informatics Center (NIC) e-Hospital application were affected, that all e-Hospital data was retrieved from an unaffected backup server and restored on new servers, and that most functions such as registration, appointment, admission and discharge were restored after two weeks.
Whether a ransom was demanded is where sources differ. Delhi Police said on 28 November that no ransom demand had been brought to notice by AIIMS. Some media reported a demand of about Rs 2 billion in cryptocurrency, and Business Today, quoting PTI sources, reported about Rs 200 crore (the same amount). The Minister of State for Health told the Lok Sabha that no specific amount was demanded, though a message on the server suggested a cyber attack.
Timeline
-
23 November 2022
AIIMS New Delhi servers go down. A PTI report says the institute allegedly faced a cyber attack on this day. Business Today says the breach was discovered on a Wednesday morning.
-
25 November 2022
The Delhi Police IFSO unit registers a case of extortion and cyber terrorism.
-
28 November 2022
The server is out of order for the sixth consecutive day. Delhi Police say no ransom demand has been brought to notice by AIIMS.
-
28 November 2022
Some media report that hackers allegedly demanded an estimated Rs 2 billion in cryptocurrency.
-
29 November 2022
Business Today, quoting PTI sources, reports a demand of about Rs 200 crore. It says Delhi Police, the Ministry of Home Affairs and CERT-In are looking into the attack.
-
29 November 2022
Patient care in emergency, outpatient, inpatient and laboratory wings is reported to be manual. Internet access on hospital computers is reportedly disabled on the advice of investigating agencies.
-
29 November 2022
Business Today reports that the NIC e-hospital database and application servers are back online, other servers are being scanned and cleaned, and antivirus is installed on nearly 1,200 of 5,000 computers.
-
About two weeks after the attack
Most e-Hospital functions such as registration, appointment, admission and discharge are restored, according to the Minister of State for Health.
-
16 December 2022
In a written Rajya Sabha reply the Minister of State for Electronics and IT says servers were compromised by unknown threat actors due to improper network segmentation, five servers were affected and about 1.3 TB of data was encrypted.
-
16 December 2022
In a written Lok Sabha reply the Minister of State for Health says data was retrieved from an unaffected backup server, no specific ransom amount was demanded and an FIR was registered with the Delhi Police Special Cell.
How the attack worked
The government has released few technical details. The points below are the ones the ministers and the reports state.
Getting in
The Minister of State for Electronics and IT said that, on preliminary analysis, servers in the AIIMS information technology network were compromised by unknown threat actors due to improper network segmentation. This caused operational disruption because critical applications stopped working. He also said AIIMS managed its own information and computer systems, and that CERT-In evaluated the incident after AIIMS informed it. The way the attackers first got in is not stated in the sources opened.
What was hit
Five physical servers on which the NIC e-Hospital application was hosted were affected. About 1.3 terabytes of data was encrypted (Data Encrypted for Impact, T1486). Business Today reported that data of several VIPs, including former prime ministers, ministers, bureaucrats and judges, was stored on the servers, and that it was feared patient data of 3 to 4 crore people could be affected. That report describes a fear; the sources opened do not confirm that data was copied out.
The message and the ransom question
A message was found on the server which suggested a cyber attack. Ministers and Delhi Police gave no ransom figure, while media reports named amounts, so sources differ on whether a demand was made.
Recovery
All e-Hospital data was retrieved from a backup server that was unaffected and restored on new servers. NIC teams scanned and cleaned other servers, and AIIMS added endpoint hardening, firewall policies and network segmentation.
- EntryUnknown threat actors compromised servers in the AIIMS network
- SpreadImproper network segmentation let the compromise disrupt critical applications
- EncryptionAbout 1.3 TB of data on five servers was encryptedTechnique T1486 (MITRE ATT&CK, opens in a new tab)
- MessageA message on the server suggested a cyber attack
- RecoveryData restored from an unaffected backup onto new servers
ATT&CK techniques
Who says who was behind it
No public attribution. The Minister of State for Electronics and IT referred to unknown threat actors (Rajya Sabha, 16 December 2022). The sources opened name no group and no malware family.
Impact
Servers: five physical servers hosting the NIC e-Hospital application were affected, and about 1.3 terabytes of data was encrypted (Minister of State for Electronics and IT and Minister of State for Health, 16 December 2022).
Operations: the Minister of State for Health said day-to-day operations, surgeries and record keeping were done in manual mode after the attack. The server was out of order for at least six days (Khaleej Times, 28 November 2022). Most e-Hospital functions were restored after two weeks.
Data: the Minister of State for Health said all e-Hospital data was retrieved from an unaffected backup server. Business Today reported that VIP data was stored on the servers and that patient data of 3 to 4 crore people could be affected. The sources opened do not say data was stolen.
Ransom: sources differ (see FAQ). Delhi Police said no demand was brought to notice by AIIMS; the Minister of State for Health said no specific amount was demanded.
Government and regulator response
- 25 November 2022: the Delhi Police IFSO unit registered a case of extortion and cyber terrorism. The Minister of State for Health later said AIIMS registered an FIR with the Delhi Police Special Cell.
- 28 November 2022: Delhi Police said no ransom demand had been brought to notice by AIIMS.
- By 29 November 2022: Business Today reported that Delhi Police, the Ministry of Home Affairs and CERT-In were looking into the attack, internet access on hospital computers was reportedly disabled, and NIC teams had brought the e-hospital database and application servers back online while scanning and cleaning the rest.
- 16 December 2022 (Rajya Sabha): the Minister of State for Electronics and IT said CERT-In and other stakeholders advised remedial measures. He said that on a ransomware incident CERT-In notifies the affected organization with remedial actions and coordinates response with service providers, sector regulators and law enforcement, and that CERT-In has formulated a Cyber Crisis Management Plan for ministries, state governments and critical sectors.
- 16 December 2022 (Lok Sabha): the Minister of State for Health said AIIMS took immediate measures such as endpoint hardening, firewall policies and network segmentation, and that CERT-In has empanelled auditing organizations for vulnerability assessment and penetration testing of public service systems, including the Ayushman Bharat Digital Mission.
Lessons
-
Segment the network
The government named improper network segmentation as the reason servers were compromised and critical applications stopped working. Separate hospital applications from each other and from the wider network.
-
Keep a backup the attacker cannot reach
All e-Hospital data was restored from a backup server that was unaffected. Test restores, and keep at least one copy that is isolated.
-
Plan for manual operation
Surgeries, records and day-to-day work ran manually after the attack, and most e-Hospital functions took about two weeks to return. Practise downtime procedures before they are needed.
-
Know who runs what
The minister said AIIMS managed its own systems while the e-Hospital application was a NIC application. Write down who patches, monitors and responds for each layer.
-
Be careful with ransom claims
Delhi Police, the health minister and media reports gave different accounts of a ransom. Confirm facts with the investigators before you speak.
-
Audit public service systems
CERT-In has empanelled auditors for vulnerability assessment and penetration testing of public service systems. Make audits regular and act on the results.
What to check in your own organization
-
Network segmentation
Draw the paths between clinical applications, admin systems and the internet. Confirm that one compromised server cannot reach all the others.
-
Backups
Confirm you have a backup that was not reachable from the main network, and time how long a full restore takes.
-
Manual mode
Keep paper forms, a downtime contact list and a bed and emergency dashboard that work without the main system. Run a drill.
-
Endpoint coverage
At one point only about 1,200 of 5,000 computers had antivirus installed. Check how many of your computers and servers have protection and monitoring today.
-
Reporting path
Know who reports a ransomware event to CERT-In, the police and your regulator, and how fast.
-
Ownership
For every hosted or shared application, list the owner for patching, logging and incident response.
-
Old systems
List obsolete and legacy systems on the network and set a date to remove or isolate them.
Where it happened
- Industry Healthcare and pharma Ransomware, stolen staff logins, patient data on leak sites and supplier exposure at hospitals and drug makers, and the rules that apply.
- Country India India is one of the world's largest digital economies, and its government reports millions of cyber incidents a year, with over 29.44 lakh handled by CERT-In in 2025. Asia Pacific
Questions
What happened at AIIMS Delhi in November 2022?
Its servers went down in a cyber attack that is dated to 23 November 2022. Five servers were affected and about 1.3 terabytes of data was encrypted, according to the Minister of State for Electronics and IT.
Was a ransom demanded?
Sources differ. Delhi Police said on 28 November that no demand had been brought to notice by AIIMS. Some media reported about Rs 2 billion (Rs 200 crore). The Minister of State for Health said no specific amount was demanded, though a message on the server suggested a cyber attack.
How did the attackers get in?
The government said unknown threat actors compromised servers because of improper network segmentation. The first point of entry is not stated in the sources opened.
Who was behind it?
No public attribution. The sources opened name no group.
Was patient data stolen?
The sources opened do not say so. Business Today reported a fear that data of 3 to 4 crore patients could be affected, and the health minister said all e-Hospital data was restored from an unaffected backup.
How long did recovery take?
The Minister of State for Health said most e-Hospital functions were restored after two weeks.
Sources
- AIIMS ransomware attack due to 'improper network segmentation': Govt in RS ETV Bharat
- AIIMS cyber attack: No ransom was demanded, most data restored, Government states in Parliament The Tribune
- Five AIIMS servers were affected, 1.3 TB of data encrypted in cyber attack: MoS IT The News Minute (PTI)
- Govt says AIIMS data retrieved, services restored Free Press Journal (PTI)
- India: Hacked AIIMS server out of order for 6th day, Delhi police say no ransom demand made Khaleej Times (ANI)
- Cyber attack at AIIMS Delhi: Hackers demand Rs 200 cr in crypto, says report Business Today
- Government's initiatives to strengthen security of cyber ecosystem, including against ransomware and Cross-Border Cybercrime (17 December 2025) Press Information Bureau, Ministry of Electronics and IT
- #StopRansomware Guide CISA
- Data Encrypted for Impact, Technique T1486 - Enterprise | MITRE ATT&CK MITRE
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.