Slobozia hospital among Romanian hospitals hit by Hipocrate ransomware attack

Overnight between February 11 and 12, 2024, attackers encrypted the production servers of the Hipocrate Information System, the platform Romanian hospitals use to manage medical activity and patient records. Slobozia County Emergency Hospital appeared on the list of affected units published by Romania's National Cyber Security Directorate.

The directorate identified the malware as Backmydata, a member of the Phobos ransomware family, and said the intrusion route was typical of that family: poorly secured remote desktop access reached through phishing or brute force. The attackers left a single demand of 3.5 bitcoin, valued at roughly 170,000 to 180,000 dollars by the outlets that covered it. No established extortion brand claimed the operation.

The counts moved quickly. The directorate's initial February 12 list named 21 hospitals with encrypted data, including Slobozia, and within days reporting put the confirmed total at 25 or 26, with a further 74 to 79 healthcare units disconnected from the internet as a precaution while investigators assessed exposure. The earliest known encryption hit a pediatric hospital in Pitesti on February 10.

Staff at affected hospitals reverted to paper records and handwritten prescriptions. Romanian authorities told the units not to contact the attackers and not to pay. Most affected hospitals held backups only one to three days old, which officials said should make restoration relatively straightforward, although one facility's most recent backup was 12 days old.