Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
Romanian hospital information system ransomware attack
In short
The Romanian hospital information system ransomware attack hit the servers behind the hospital information system (HIS) used by many Romanian hospitals in the night of 11 to 12 February 2024. The Ministry of Health listed 18 affected units, and the national cyber directorate DNSC later spoke of more than 25 hospitals. DNSC said the ransomware was Backmydata, from the Phobos family, and that attackers asked for 157,000 euros in Bitcoin.
What happened
In the night of 11 to 12 February 2024, a massive ransomware attack hit the production servers that run the HIS hospital information system, the Ministry of Health said on 12 February. The ministry said the system stopped working and that files and databases were encrypted. Its notice listed 18 affected medical units, from national institutes in Bucharest to county hospitals.
The DNSC, Romania’s national cyber security directorate, said on the evening of 12 February that 21 hospitals were affected and that 79 other health units were disconnected from the internet while checks continued. The count kept rising. Five more hospitals and clinics confirmed they were hit on 13 February, and on 14 February DNSC spoke of more than 25 hospitals. Radio Romania International counted 25 public and private units.
Sources differ on where the attack landed. The ministry spoke of production servers running the HIS system. DNSC described a ransomware attack on a service provider for several hospitals. Europa Libera, the Romanian service of RFE/RL, reported that the hospitals rent the system from an IT firm whose server was reported attacked.
DNSC said the program was Backmydata ransomware, a virus from the Phobos family. The attackers asked for 157,000 euros in Bitcoin. Their message named no group, only an e-mail address. Over 400 patients who needed admission had to wait on Monday 12 February, and hospitals moved to working locally on their own computers.
Timeline
-
10 February 2024
A children's hospital in Pitesti is affected earlier than the others (DNSC, via Europa Libera).
-
11 to 12 February 2024 (night)
Ransomware hits the servers that run the HIS hospital system.
-
12 February 2024
The Ministry of Health publishes a notice listing 18 affected units and says systems and databases are encrypted.
-
12 February 2024 (evening)
DNSC says 21 hospitals are affected and 79 other health units are disconnected from the internet.
-
12 February 2024
DNSC names the ransomware as Backmydata, from the Phobos family, and a team goes to the site.
-
13 February 2024
Five more hospitals and clinics confirm they were hit. DNSC reports a ransom demand of 157,000 euros in Bitcoin and no sign yet of personal data being compromised.
-
14 February 2024
DNSC adds a hospital in Smeeni to the more than 25 hospitals hit on 12 February; it reported late because of a power cut.
-
14 February 2024
Radio Romania International reports that the organized crime prosecutor DIICOT is investigating, after two maintenance companies notified the authorities.
How the attack worked
What the sources say about the entry route
None of the pages opened says how the attackers got in. The ministry and DNSC describe an attack on the servers that run the hospital information platform, and DNSC described a ransomware attack on a service provider for several hospitals. Europa Libera reported that hospitals rent the system from an IT firm whose server was reported attacked. DNSC also said the provider of the application informed it before the hospitals made any formal notice.
Encryption with Backmydata
DNSC said it was investigating an attack executed with the Backmydata ransomware, a virus from the Phobos ransomware family. The ministry said files and databases were encrypted. This is Data Encrypted for Impact (T1486), which MITRE ATT&CK describes as encrypting data on target systems to cut availability.
Why many hospitals fell at once
The hospitals used one shared platform. Because of that, one attack on the servers behind it reached many units. Other units that were not encrypted were cut off from the internet as a precaution, which DNSC counted at 79 units on 12 February and the health minister described as dozens of hospitals. One hospital manager said the program was isolated and that services continued locally on hospital computers.
Earlier Phobos cases in Romanian hospitals
In July 2021 the Romanian Intelligence Service (SRI) said a Phobos attack on a Bucharest hospital was similar to attacks in summer 2019 on four other hospitals. The SRI said Phobos mostly spreads through Remote Desktop Protocol (RDP) connections and that the earlier hospitals lacked antivirus protection. That statement is about the earlier cases. It does not say how the 2024 attackers entered.
- ReachAttackers got to the servers behind the hospital information platform; the entry route was not published in the pages opened
- EncryptBackmydata ransomware encrypted files and databasesTechnique T1486 (MITRE ATT&CK, opens in a new tab)
- SpreadMany hospitals that used the shared system were hit; others were cut off as a precaution
- DemandA message asked 157,000 euros in Bitcoin and named no group
- Fall backHospitals worked locally on their own computers while systems were rebuilt
ATT&CK techniques
Who says who was behind it
No public attribution. DNSC said the attackers' message named no group, only an e-mail address (via Europa Libera, 13 February 2024). Radio Romania International reported on 14 February 2024 that the attack was not claimed. DNSC said the attackers had not been publicly identified.
Impact
Hospitals: the Ministry of Health listed 18 affected units on 12 February 2024. DNSC counted 21 hospitals that evening, 26 after five more confirmed on 13 February, and more than 25 on 14 February. Radio Romania International counted 25 public and private units. The numbers differ because the count kept changing and the outlets counted at different times.
Precautionary shutdowns: DNSC said 79 other health units were disconnected from the internet on 12 February. The health minister spoke of dozens of hospitals disconnected so the effects would not spread.
Patients: over 400 patients who needed admission had to wait on Monday 12 February (Europa Libera). Hundreds of patients waited, according to Radio Romania International.
Billing: Europa Libera reported that if services could not be entered in the system, hospitals could not get money from the health insurance fund, and the rules for reporting and settling were still to be set.
Data: on 13 February DNSC said there was no sign yet that personal data had been compromised. Sources opened do not report a data leak.
Ransom: the attackers asked for 157,000 euros in Bitcoin. The sources opened do not say anyone paid, and authorities advised not to pay.
Cost and recovery time were not stated in the sources opened.
Government and regulator response
- 12 February 2024: The Ministry of Health said the incident was under investigation by IT specialists including DNSC cyber security experts, that exceptional precautions were activated for other hospitals, and that all hospitals running this type of system took safety steps, including limiting internet access and saving data to external media.
- 12 February 2024: DNSC sent a team to the site, disconnected 79 other health units from the internet, and identified the ransomware as Backmydata, from the Phobos family.
- 13 February 2024: DNSC and other authorities advised all affected units not to pay the ransom and not to contact the attackers.
- 14 February 2024: DNSC reminded providers of essential services that they must take prevention steps and inform DNSC about incidents. Radio Romania International reported that DNSC worked with the SRI to restore the systems and that DIICOT opened an investigation for illegal access to a system, disruption of computer systems and illegal operations with programs or devices.
- 14 February 2024: The health minister said the institutions would develop a new technical standard to prevent such attacks.
Lessons
-
One supplier can stop many hospitals
The hospitals used one hosted system. When the servers behind it were hit, 18 units were named on day one and more than 25 within two days. Know which suppliers run a single system for many sites.
-
Cutting links limits the spread
DNSC disconnected 79 other units from the internet on the first day, and the ministry limited internet access in all hospitals running the system.
-
A local fallback keeps care moving
One manager said services continued locally on hospital computers. Even so, over 400 patients waited on the first Monday.
-
Plan the money side too
Hospitals rent the system, and unrecorded services could not be billed to the insurance fund. Agree in advance how to record and settle care when the system is down.
-
Know the older cases
The SRI said Phobos hit four hospitals in 2019 and another in 2021, mostly through Remote Desktop Protocol, and that antivirus was missing. Past incidents are a guide to the common weak points.
-
Report fast and do not pay
The provider told DNSC before any formal notice from the hospitals. Authorities advised not to pay and not to contact the attackers.
What to check in your own organization
-
Shared systems
List every system your hospital or company uses that a single supplier runs for many customers, and ask how an attack on the supplier would reach you.
-
Isolation plan
Write down who can disconnect which links within minutes, and test it, so a clean unit can be cut off before a spread.
-
Remote Desktop
Find every Remote Desktop service exposed to the internet and switch it off or put it behind a secure gateway. The SRI named RDP as the usual route for Phobos.
-
Offline backups
Keep backups of critical data on media that are offline, and test that you can restore the hospital system from them.
-
Paper and local fallback
Prepare a way to admit, treat and record patients without the central system, and a plan to enter the data afterwards.
-
Antivirus coverage
Check that every server and workstation has current protection, because the SRI linked the earlier Phobos cases to missing antivirus.
-
Notification route
Agree who tells the national cyber directorate, and how fast, when a supplier or your own unit is attacked.
Where it happened
Questions
How many Romanian hospitals were affected?
It depends on the date and source. The Ministry of Health listed 18 units on 12 February 2024. DNSC said 21 hospitals that evening, then 26 after five more confirmed, and spoke of more than 25 on 14 February. DNSC also said 79 other units were disconnected as a precaution.
What ransomware was used?
DNSC said it was Backmydata, a virus from the Phobos ransomware family.
Who was behind it?
No public attribution. The ransom message named no group, only an e-mail address, and the attack was not claimed.
Was patient data stolen?
On 13 February DNSC said there was no sign yet that personal data had been compromised. The sources opened do not report a leak.
How did the attackers get in?
The pages opened do not say. The SRI said in 2021 that Phobos mostly spreads through Remote Desktop Protocol connections, but that statement is about earlier cases.
Did hospitals pay the ransom?
The sources opened do not say. Authorities advised all affected units not to pay.
Sources
- Atac cibernetic masiv de tip ransomware asupra serverelor de productie pe care ruleaza sistemul informatic HIS (12 February 2024) Ministerul Sanatatii
- Crește numărul spitalelor atacate cibernetic. Recompensa, cerută în Bitcoin. Ce firme gestionează sistemul informatic (updated 14 February 2024) Europa Libera Romania (RFE/RL)
- 21 spitale din București și din țară, atacate cibernetic. Datele pacienților nu pot fi accesate de către medici Europa Libera Romania (RFE/RL)
- Massive cyber attack on Romanian hospitals (14 February 2024) Radio Romania International
- Atac cibernetic cu aplicația ransomware PHOBOS (22 July 2021) Serviciul Roman de Informatii
- Data Encrypted for Impact, T1486 MITRE ATT&CK
- #StopRansomware: Phobos Ransomware CISA
- #StopRansomware Guide CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.