The Saint Gheorghe Recovery Hospital in Botoşani, in northeastern Romania, was hit by a ransomware attack in December that is still impacting medical operations.
The hospital is not able to report the services performed in December 2022 and for this reason, it cannot receive payment for the medical services provided.
The threat actors demanded a ransom of 3 Bitcoin to decrypt the data on the infected systems. It seems that the attackers abused a remote connection used for maintenance purposed by a third-part service provider.
“The attack is similar to the one in the summer of 2019, when four other hospitals in Romania were targeted. The hackers apparently got through by using a remote connection accessed by one of the maintenance companies.” reported the website Romania Insider. “The hackers entered the system and encrypted the December database. After that, they left a message, in English, asking for a ransom of 3 Bitcoin, or approximately EUR 46,400.”
According to the media outlet, the attack was sophisticated, and both the Romanian Directorate for Investigating Organized Crime and Terrorism (DIICOT) and the Romanian antivirus firm BitDefender were not able to decrypt the files.
“We have already notified the National Directorate of Cyber Security and DIICOT. An investigation has been launched and we are waiting to see what happens. I cannot say more at the moment. It is certain that from Monday we hope to resume medical activity at normal capacity,” said doctor Cătălin Dascălescu, the manager of the Recovery Hospital.
In 2019 other four hospitals in Romania suffered ransomware attacks that were attributed to the PHOBOS extortion group.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Saint Gheorghe Recovery Hospital)
[adrotate banner=”5″]
[adrotate banner=”13″]
Security Affairs Malware newsletter includes a collection of the best articles and research on malware…
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best…
Fintech firm Figure confirmed a data breach after hackers used social engineering to trick an…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in BeyondTrust RS and…
A new alleged Russia-linked APT group targeted Ukrainian defense, government, and energy groups, with CANFAIL…
A new threat actor, UAT-9921, uses the modular VoidLink framework to target technology and financial…
This website uses cookies.