Tertius News is an AI-native newsroom: an AI model reads the source articles linked below — on this story, all of them from one outlet — and extracts what that outlet reported, claim by claim. How this works →

How 100 Romanian hospitals switched to pen and paper to defeat a national cyber-attack

In February 2024, Romanian hospitals faced a coordinated ransomware attack that forced more than 100 facilities offline. The quick decision to disconnect from the internet and the shift to manual processes helped avert patient harm, providing a test case for global disaster planning.

By Tertius News AI Desk 1 outlet · 2 articles Version 1 Coverage Jun 23, 2026 Published Aug 14

Lead

When calls started streaming into Romania's national cyber-security centre about hospitals being hit by ransomware, officials faced a stark choice. Cyber-chief Dan Cimpean ordered more than 100 hospitals to disconnect from the internet, a move that halted the attackers' spread but forced medical staff to revert to pen and paper.

The attack, which began on 10 February 2024, targeted a widely used medical software system called Hippocrates, which was breached through Bucharest-based firm RSC. The ransomware strain, known as BackMyData, infected 26 hospitals and demanded a ransom of €160,000 in bitcoin, according to multiple reports.

Coverage comparison

The BBC's reporting, which was the sole source for this article, describes the incident as one of the worst healthcare cyber-attacks globally. The coverage focuses on the rapid response by Romanian authorities and the subsequent reliance on manual procedures.

Key claims

Attack scope: The ransomware hit at least 26 hospitals, with more than 100 hospitals intentionally disconnected from the internet as a containment measure.
Software breach: The Hippocrates medical system, used for patient management and clinical workflows, was compromised via the software provider RSC.
Ransom demand: Attackers sought €160,000 in bitcoin; Romanian authorities decided not to pay, a choice that was widely reported.
Recovery and impact: No deaths or serious patient harm were reported. The use of regular backups allowed some organisations to recover more quickly, though this claim was noted by only one source.

Perspectives

Official and institutional viewpoint

Romania's DNSC co-ordinated the response, and its director Dan Cimpean was central to the decision to cut off hospitals. Officials have emphasised that the move bought critical time and contained the spread.

Medical staff perspective

Surgeons like Oana Goidescu described the disruption as deeply challenging, as all digital records—from lab requests to medication orders—were suddenly inaccessible. Despite the difficulties, staff improvised and adapted.

Broader security context

The FBI has highlighted healthcare as the most targeted critical national infrastructure sector. This incident underscores the growing threat and the importance of contingency planning.

Analysis

While the BBC's reporting is detailed and credible, it is the only source used in this analysis. The claim about backups aiding recovery was mentioned by a single source and carries medium confidence. The broader assessment of the attack's significance, however, appears well-supported.

The decision to go offline, though drastic, has been widely praised. It highlights a practical tension: disconnecting systems can stop attackers, but it also halts digital healthcare operations. The Romanian experience offers lessons for other countries, but it also raises questions about the sustainability of such measures in longer crises.

As cyber threats to healthcare grow, the incident serves as a reminder that robust backup systems and manual fallback procedures are not just best practice—they can be essential in an emergency.

How this outlet told it

BBC — World as of Jun 23, 2026, 2:00 AM UTC

Framing: Cyber attack on Romania's hospitals — Informative

Facts Included:

Cyber attack on Romania's hospitals in February 2024
100 hospitals disconnected from the internet
Hippocrates medical software was breached
Ransomware strain called BackMyData was used
€160,000 ransom demand in bitcoin
26 hospitals were infected
No reported deaths or serious harm to patients

Read the source article →

BBC — World as of Jun 23, 2026, 9:30 AM UTC

Framing: Cyber attack on Romania's hospitals — Informative

Facts Included:

Cyber attack on Romania's hospitals in February 2024
100 hospitals disconnected from the internet
Hippocrates medical software was breached
Ransomware strain called BackMyData was used
€160,000 ransom demand in bitcoin
26 hospitals were infected
No reported deaths or serious harm to patients

Read the source article →

What was claimed, and who backed it

Each row is one claim, attributed to the outlet whose wording states it most clearly. Confidence rates how directly the source text states the claim — explicit and unhedged rates high; hedged, pieced-together, or internally inconsistent statements rate lower. It does not measure whether the claim is true. Status counts the distinct outlets we found asserting it — so a single-source claim can still show high confidence, and a multi-source claim can show medium. Every one of those outlets is named beside the status, so you can check the count against the list. For claims extracted before we began storing that list, the row says so: it names the outlet the claim is quoted from and states that we have not recorded which outlets backed it. Outlets wrote at different times, so a figure that evolves — a casualty count, for example — can legitimately differ between rows; check the "as of" time next to each claim's source.

Claim	Confidence	Status
ClaimA cyber attack on Romania's hospitals occurred in February 2024, targeting the healthcare system.	ConfidenceHigh	StatusSingle-source via BBC — World as of Jun 23, 2026, 2:00 AM UTC
ClaimMore than 100 hospitals were disconnected from the internet to stop the hackers.	ConfidenceHigh	StatusSingle-source via BBC — World as of Jun 23, 2026, 2:00 AM UTC
ClaimThe ransomware strain used in the attack was called BackMyData.	ConfidenceHigh	StatusSingle-source via BBC — World as of Jun 23, 2026, 2:00 AM UTC
ClaimThe attackers demanded a ransom of €160,000 in bitcoin.	ConfidenceHigh	StatusSingle-source via BBC — World as of Jun 23, 2026, 2:00 AM UTC
Claim26 hospitals were infected with the BackMyData ransomware.	ConfidenceHigh	StatusSingle-source via BBC — World as of Jun 23, 2026, 2:00 AM UTC
ClaimNo reported deaths or serious harm to patients occurred as a result of the attack.	ConfidenceHigh	StatusSingle-source via BBC — World as of Jun 23, 2026, 2:00 AM UTC
ClaimThe Hippocrates medical software was breached during the attack.	ConfidenceHigh	StatusSingle-source via BBC — World as of Jun 23, 2026, 2:00 AM UTC
ClaimHealthcare is now the most targeted area of critical national infrastructure, according to the FBI.	ConfidenceMedium	StatusSingle-source via BBC — World as of Jun 23, 2026, 2:00 AM UTC
ClaimA national decision was taken not to pay the ransom demand.	ConfidenceHigh	StatusSingle-source via BBC — World as of Jun 23, 2026, 2:00 AM UTC
ClaimRegular backups allowed organisations to recover more quickly from the attack.	ConfidenceMedium	StatusSingle-source via BBC — World as of Jun 23, 2026, 2:00 AM UTC

Transparency & Audit Trail

1 outlet · 2 articles consulted: BBC — World 10 claims extracted Version 1 Written 2026-08-14