BOLOGNA, Italy — Doctors at seven hospitals in the Po Valley were writing prescriptions by hand and reading X-rays off portable drives on Wednesday, four days after a ransomware attack encrypted the patient records of a regional health network that serves about 1.4 million people.
The network, which officials declined to identify by name while the investigation continues, said 2,300 scheduled operations had been postponed, emergency departments were accepting only urgent cases, and laboratory results were being carried between floors on paper. No deaths have been attributed to the outage. A criminal group has demanded 4 million euros in cryptocurrency and threatened to publish records of roughly 600,000 patients; the network said it would not pay.
“I have been a doctor for 31 years, and I have never been so grateful that I learned medicine before computers,” said Marco Benassi, an emergency physician at the largest of the affected hospitals. “We know how to treat a heart attack without a screen. What we cannot do is find out what medication you were given last Tuesday.”
Italy’s National Cybersecurity Agency said the intruders appeared to have entered through a remote-access account belonging to a maintenance contractor and had spent at least 11 days inside the network before triggering the encryption early Saturday. “Health care is the softest large target in Europe,” said Giulia Ferraresi, who coordinates the agency’s incident response. “Old equipment, thin budgets, and a culture in which the priority, rightly, is the patient in front of you rather than the password.”
The attack is the fourth on a European hospital system this year to force a return to manual operations, following incidents in Spain, Romania, and Ireland. Under the E.U.’s cybersecurity directive, hospitals above a certain size must now report serious incidents within 24 hours, a rule the regional network complied with. Compliance with the directive’s harder requirements, such as network segmentation and offline backups, is patchier.
The network had backups, Ms. Ferraresi said, but some were connected to the same network and were also encrypted. Restoring the remainder is expected to take two to three weeks. In the meantime, patients with chronic conditions have been asked to bring their own medication lists.
Luciano Pedrini, 71, had a hip replacement scheduled for Monday that was canceled by telephone. “They said the computer is sick,” he said outside the hospital in Bologna, where he had come to collect a paper copy of his file. “I told them I am also sick. We agreed the computer goes first.”
Prosecutors in Bologna have opened a criminal inquiry. The regional government said on Wednesday that it would bring forward 90 million euros in planned I.T. spending, which Dr. Benassi greeted with a shrug. “They say that after every attack,” he said. “Then they buy an M.R.I. machine, which I also want. That is the problem in one sentence.”
A version of this article appears in print on Oct. 12, 2026, Section A, Page 5 of the European edition with the headline: Ransomware Attack Sends Hospitals Across Northern Italy Back to Paper and Pen.
