When 100 Hospitals Were Forced Offline: What the Romania Incident Reveals About Cyber Resilience in Healthcare Environments

In highly digitalized environments such as healthcare, manufacturing, semiconductor production lines, and critical infrastructure, the impact of a cybersecurity incident often goes far beyond data leakage or system abnormalities. When daily operations rely heavily on digital systems, third-party platforms, and connected devices, the real risk of an attack is that core services or operational processes may be forced to stop. The key to cyber resilience is not only whether an organization can detect an attack, but whether it can quickly limit the scope of impact when an attack occurs, allowing essential operations to continue.

Incident Review: A Ransomware Incident That Forced Hospitals Back to Paper-Based Operations

In February 2024, multiple hospitals in Romania experienced a ransomware incident. The attack affected a healthcare management system used by several medical institutions, causing some hospital systems and databases to be encrypted. To prevent the attack from spreading further, additional hospitals were forced to proactively disconnect from the network.

Public reports indicated that around 25 hospitals had their data encrypted, while another 75 hospitals using the same platform were asked to disconnect for investigation. Later reports also stated that more than 100 healthcare institutions were affected or forced to adopt offline response measures.

As digital systems became unavailable, some hospitals had to temporarily return to paper-based workflows to maintain patient care, registration, and daily medical operations. This incident is worth noting not only because of its broad impact, but also because it clearly reflects a common challenge faced by healthcare and other highly connected environments: when a shared system or third-party platform is compromised, the impact can quickly spread across the entire operational ecosystem.

Insight 1: Third-Party Systems Can Become Large-Scale Propagation Points

This incident was not an isolated attack on a single hospital. Instead, multiple healthcare institutions relied on the same system platform, and once that platform was affected, the risk expanded rapidly.

This is becoming an increasingly important cybersecurity challenge for modern healthcare environments. Hospitals do not rely solely on internal systems for daily operations. They also depend heavily on healthcare information systems, laboratory systems, imaging systems, external maintenance services, cloud platforms, outsourced vendors, and supplier connections. While these systems improve operational efficiency, they also make the risk boundary far more complex.

When a third-party platform or shared system encounters a security issue, the impact may not remain limited to a single organization. It may spread across campuses, systems, and organizations. Therefore, cybersecurity protection in healthcare environments should not focus only on whether a single endpoint or system is secure. Organizations must also understand the overall communication relationships and dependency structure.

Insight 2: Ransomware Does Not Need to Attack Medical Devices Directly to Disrupt Healthcare Services

Cybersecurity risks in healthcare environments do not always come from direct attacks on medical devices. Even if the attack targets management systems, databases, file servers, or scheduling platforms, it may still indirectly affect healthcare services.

When hospitals cannot access patient data, review examination records, or use registration and management systems, medical staff still need to care for patients. However, workflows may be forced to downgrade. Moving from digital processes back to paper-based operations increases pressure on frontline staff and may also raise the risk of communication errors, data delays, and reduced service efficiency.

This reminds us that healthcare cybersecurity is not only about protecting information systems. It is also about protecting the continuity of healthcare services. The real question is not only “Which device was attacked?”but“Which systems, if interrupted, would affect patient care and hospital operations?”

Insight 3: Full Network Disconnection Is Effective, but Costly

In the Romania hospital incident, many hospitals were asked to disconnect immediately to prevent the attack from spreading and to buy time for investigation. This approach can be effective in an emergency, but the cost is also clear: digital processes are disrupted, systems become unavailable, internal communication is limited, and frontline staff must rely on manual processes to maintain services.

For healthcare environments, full network disconnection is not an ideal state. Hospitals cannot stop providing medical services simply because IT systems are down. What they truly need is more precise isolation capability: the ability to determine which areas need to be disconnected immediately, which systems can continue operating safely, which communications are necessary for core services, and which connections may create propagation risks.

Cyber resilience does not mean keeping every system online forever. It means ensuring that disruption can be controlled within an acceptable range. Instead of being forced to choose between “everything connected” and “everything disconnected” during an incident, organizations need layered, segmented, and system-level risk control.

Insight 4: Backups Are Important, but They Cannot Replace Operational Resilience

In ransomware incidents, backups are often critical to recovery. If an organization has recent and usable backups, it can reduce the risk of permanent data loss and avoid being forced to pay ransom.

However, backups cannot solve everything. Even if data can eventually be restored, hospitals still need to deal with system downtime, infection scope assessment, service restoration, workflow adjustments, and cross-department coordination. In other words, backups can support data recovery, but they cannot fully prevent operational disruption.

Healthcare environments therefore need more than a single line of defense. They need a complete resilience design. In addition to backups, organizations need clear system visibility, network segmentation, access control, anomaly isolation, recovery procedures, and business continuity planning. Only when these capabilities are designed in advance can organizations reduce the real impact of an attack.

Insight 5: Cybersecurity Is Shifting From “Preventing Intrusion” to “Controlling Spread”

In the past, many organizations focused cybersecurity efforts on preventing attacks from entering, detecting threats, or patching vulnerabilities. But in highly connected healthcare environments, completely preventing every attack has become increasingly difficult. The more realistic question is: when an attack does occur, can the organization control how far it spreads?

The Romania hospital incident shows that when risk may spread across systems, campuses, and platforms, the key action is not generating more alerts. It is quickly establishing boundaries, cutting off unnecessary connections, and preserving the minimum communication paths required for core services.

This reflects a broader shift in cybersecurity thinking. Cybersecurity is no longer only about whether an organization can block an attack. It is about whether an organization can keep an attack localized even when it happens. When a single incident does not escalate into a full operational shutdown, the organization has true operational resilience.

【Janus Perspective】See the Risk, Limit the Spread, Maintain Operations

The Romania hospital incident reminds us that healthcare environments, like other highly connected operational environments, must face the cybersecurity challenges brought by digitalization. When systems, platforms, devices, and third-party services are interconnected, cybersecurity incidents are no longer just IT issues. They become questions of whether core services can continue to operate.

For Janus, the core value of cybersecurity protection is not only detecting anomalies, but helping organizations establish controllable security boundaries. Organizations need to see how internal systems actually communicate, understand which connections are necessary, identify which paths may create propagation risks, and have the ability to quickly limit the scope of impact when an incident occurs.

True cyber resilience does not mean convincing an organization that it will never be attacked. It means enabling the organization to protect core services, control the blast radius, and recover in a more predictable way when an attack occurs.

In healthcare and other highly connected environments, cybersecurity is not merely a technical issue. It is the foundation of operational stability and service continuity. The focus of future protection will continue to shift from “Can we see the threat?” to “Can we control the spread of risk?”

When attacks cannot be completely avoided, the ability to keep them localized becomes the real difference in operational resilience.

References:

BBC News, How 100 Romanian hospitals switched to pen and paper after cyber-attack