More than 100 hospitals in Romania were affected by a crypto ransomware attack on Tuesday, the National Cyber Security Directorate (DNSC) confirmed. The unidentified perpetrators have demanded 3.5 Bitcoin (BTC), or about $180,000, to decrypt the data.
The ransomware took down over 100 hospitals, affecting their IT systems and encrypted data, forcing the hospitals to operate offline.
Per a recent update from the DNSC, 25 hospitals in Romania using Hipocrate Information System (HIS) are directly affected by the attack. As a result of the attack, the system is down, files and databases are encrypted, the Ministry of Health noted.
The incident is under investigation by IT specialists, including cybersecurity experts from the National Cyber Security Directorate, and resumption possibilities are being assessed, the Ministry added. However, it did not specify whether the authorities are ready to pay the ransom in Bitcoin, as demanded by attackers.
Dubbed ‘Backmydata’, the ransomware is a variant of Phobos family. The ransom note informs victims about the severity of the situation by threatening to sell confidential data if negotiations fail. The note asserts that data can be returned only when the ransom is paid in digital assets.
Furthermore, hospitals in Romania are told to keep an eye on ransom demands to ensure evidence is preserved.
This isn’t a new case where attackers have demanded Bitcoin ransom payment. The Backmydata has similarities with the infamous WannaCry attack in May 2017 on the UK’s National Health Service (NHS).
In 2021, the Russian DarkSide Group attacked the US Colonial Pipeline, demanding a ransom of $5 million worth in crypto assets. Later, the US Department of Justice recovered $2.3 million in Bitcoin from the DarkSide (approximately 63.7BTC at that time).
Additionally, a recent report from Chainalysis noted that ransomware payments hit a staggering $1 billion in 2023. Notable victims included household names like the BBC and British Airways, and other high-profile institutions.
The rise in crypto ransomware attacks underscores the need for robust cybersecurity measures across all sectors. As attackers continue to target vulnerable organizations, experts recommend prioritizing strong data encryption, regular backups, employee training, and proactive threat detection systems.
The Romanian hospitals’ attack serves as a stark reminder of the devastating impact ransomware attacks can have on critical institutions. As the investigation unfolds, it remains to be seen whether authorities will pay the ransom or explore alternative solutions. The incident highlights the urgent need for global collaboration and strengthened cybersecurity defenses to tackle the growing threat of cyber attacks targeting essential services.
As the healthcare sector grapples with the aftermath of this attack, patients’ lives and sensitive medical information remain at risk. The restoration of affected hospitals’ systems is of utmost importance to ensure uninterrupted healthcare services to the public.
In conclusion, the ransomware attack on over 100 Romanian hospitals has caused substantial disruption, leaving healthcare providers offline and demanding a significant Bitcoin ransom. As authorities work to regain control and investigate the incident, the focus must shift towards fortifying cybersecurity measures to protect critical infrastructure and safeguard public welfare.
