Hospital Ransomware Attacks: Lessons from Recent Incidents and How to Protect Your Clinic

On November 23, 2022, India’s most prestigious public hospital effectively went dark. AIIMS Delhi’s digital systems — patient records, appointment scheduling, billing, even its e-Hospital platform — were taken offline by a ransomware attack, forcing thousands of patients into manual, paper-based workflows for weeks. The incident remains the single clearest illustration of what’s at stake when a healthcare facility’s cybersecurity fails, and it established the regulatory and practical playbook every Indian clinic and hospital should now understand.

What Happened at AIIMS Delhi

The ransomware attack disrupted five core servers, forcing AIIMS to switch entirely to manual operating procedures to keep clinical services running. New inpatient registration was down for days, patients queued for hours at registration counters that would normally process requests digitally in minutes, and while already-admitted patients continued receiving care, new appointments and administrative processes ground to a halt. Reports at the time indicated the data of approximately 3-4 crore patients, including high-profile individuals, was potentially exposed, and attackers reportedly demanded a ransom of around ₹200 crore (30 bitcoins) — reflecting how seriously the attackers themselves valued the sensitivity and disruption potential of the data they had encrypted.

The Response: What a Serious Institutional Reaction Actually Looks Like

AIIMS’s response illustrates the multi-agency coordination a serious healthcare cyber incident in India now triggers: the hospital isolated infected systems to contain the spread, engaged CERT-In and the National Informatics Centre, and brought in external cybersecurity consultancy support. Delhi Police’s Intelligence Fusion and Strategic Operations (IFSO) unit registered a criminal case, and the investigation was ultimately escalated to involve the Ministry of Home Affairs, the National Investigation Agency, and even international coordination through Interpol. Two system analysts were suspended pending investigation. Despite this scale of response, the servers reportedly remained affected for roughly two weeks, illustrating how even a well-resourced, high-priority institution can face a prolonged, disruptive recovery.

This Was Not an Isolated Incident

AIIMS Delhi has faced repeated cybersecurity issues beyond the 2022 attack — including a separate vulnerability discovered in May 2025 that exposed sensitive personal and medical data of voluntary organ and tissue donors registered with its Organ Retrieval Banking Organisation (ORBO), which was disclosed by an independent researcher and patched by June 2025. More broadly, healthcare has consistently ranked among the most heavily targeted sectors in India’s cyber threat landscape — one 2021 analysis found India’s healthcare sector accounted for 7.7% of global healthcare-industry cyberattacks and nearly 30% of healthcare attacks within the Asia-Pacific region specifically, with attack volume rising sharply year over year.

Why Healthcare Is a Particularly Attractive Target

• Data value: medical records contain uniquely sensitive, hard-to-change personal information (diagnoses, treatment history, sometimes financial and identity data) that commands a premium on illicit markets compared to more easily replaceable data like credit card numbers.
• Operational urgency creates ransom leverage: unlike many other sectors, a hospital facing a systems outage cannot simply wait out an attack — patient safety and continuity of care create intense pressure to pay a ransom quickly, which attackers understand and exploit.
• Historically under-invested security infrastructure: many Indian healthcare facilities, particularly smaller and mid-size ones, have prioritised clinical and infrastructure spending over cybersecurity investment relative to sectors like banking, leaving genuine, exploitable gaps.
• Rapid digitisation outpacing security maturity: the push toward ABDM integration, e-prescriptions, and digital hospital management systems (all covered elsewhere in this series) expands the digital attack surface faster, in many cases, than security practices have matured to match.

The Legal Obligation Every Hospital Should Know: CERT-In’s 6-Hour Rule

The Indian Computer Emergency Response Team (CERT-In), operating under the Ministry of Electronics and Information Technology, issued binding directions on April 28, 2022, that took effect from June 28, 2022, introducing a mandatory six-hour window for reporting specified categories of cyber incidents. The reportable categories explicitly include data breaches and data leaks — squarely covering the kind of incident a hospital or clinic ransomware attack, or an unauthorised data exposure, would constitute. The Directions apply broadly across service providers, intermediaries, data centres, and body corporates — the presumption is inclusion rather than a narrow, sector-specific list, meaning hospitals and clinics of essentially any size should treat themselves as covered rather than assuming an exemption.

Beyond the six-hour reporting requirement itself, the Directions impose three further obligations relevant to any healthcare IT setup: synchronising all ICT system clocks with the official NIC or NPL Network Time Protocol server, maintaining ICT system logs for a rolling 180-day period stored within India, and responding to any CERT-In information request within six hours of receiving it.

How This Connects to the DPDP Act

CERT-In’s six-hour reporting obligation operates alongside, not instead of, the separate breach notification requirements under the Digital Personal Data Protection Act, 2023, covered in detail elsewhere in this series — a hospital experiencing a ransomware attack involving patient data may need to satisfy both CERT-In’s technical incident-reporting timeline and the DPDP Act’s separate obligation to notify the Data Protection Board of India and affected patients. Treating these as two distinct, both-mandatory obligations, rather than assuming one satisfies the other, is essential for genuine compliance.

A Practical Protection Checklist for Clinics and Hospitals

1. Maintain offline, regularly tested backups of critical patient data and systems, so that a ransomware attack encrypting live systems doesn’t mean losing access to records entirely — the AIIMS incident’s forced return to manual operations illustrates why backup accessibility, not just backup existence, matters.
2. Segment critical clinical systems from general administrative networks, so that a breach in one area (say, a compromised staff email account) doesn’t automatically cascade into core patient record or life-support-adjacent systems.
3. Establish a documented incident response plan before an attack happens, specifically covering who is responsible for CERT-In notification within the six-hour window, who handles DPDP Act patient notification, and who manages continuity of clinical care during a systems outage.
4. Train staff on phishing and social engineering recognition, since a significant share of ransomware incidents begin with a compromised credential or a successfully phished staff member rather than a sophisticated direct system exploit.
5. Apply security patches and software updates promptly, particularly for any system connected to ABDM or handling patient data, since unpatched, known vulnerabilities remain one of the most common entry points for attackers.
6. Engage a qualified cybersecurity partner for a genuine risk assessment, rather than assuming smaller size or lower profile makes a clinic an unlikely target — attackers frequently target less-defended smaller facilities precisely because larger institutions have hardened their defences.

Frequently Asked Questions

Does the CERT-In 6-hour reporting rule apply to a small, single-location clinic?

The Directions apply broadly, with inclusion as the presumption rather than a narrow list of covered sectors — a small clinic should not assume it is exempt simply due to its size, and should treat itself as covered unless it has specific legal advice confirming otherwise.

What actually needs to be reported to CERT-In within six hours?

Specified categories of cyber security incidents, explicitly including data breaches and data leaks, along with several other categories like unauthorised access to IT systems and website defacement — hospitals should maintain awareness of the full reportable-incident list rather than assuming only a full-scale ransomware attack qualifies.

Is CERT-In reporting the same as DPDP Act breach notification?

No, these are separate, both-mandatory obligations — CERT-In’s six-hour rule is a cybersecurity incident reporting requirement to a technical authority, while the DPDP Act separately requires notifying the Data Protection Board of India and affected individuals about a personal data breach specifically.

How long did it take AIIMS Delhi to fully recover from its 2022 ransomware attack?

Reports at the time indicated the affected servers remained disrupted for roughly two weeks, with a broader, more gradual return to full pre-incident digital operations taking longer, illustrating how prolonged recovery can be even for a well-resourced institution.

What is the single most important preventive step a small clinic can take?

Maintaining regularly tested, offline (or otherwise isolated) backups of critical patient data is widely regarded as the single most protective measure against ransomware specifically, since it removes the core leverage a ransomware attacker relies on — the threat of permanently losing access to your own data.

Researched Sources

1. CM-Alliance — AIIMS Ransomware Attack (Educational Timeline)
2. BankInfoSecurity — Ransomware Disrupts Indian Premier Hospital for 2nd Day
3. P.I.V.O.T Security — Cyber Resilience in Healthcare: Lessons from AIIMS Delhi’s Cybersecurity Battles
4. Siri Law LLP — CERT-In 6-Hour Reporting Rule: A Comprehensive Guide

Disclaimer

This article is for general informational and educational purposes and reflects publicly reported information about past cyber incidents and the CERT-In regulatory framework as understood at the time of writing. It is not legal or cybersecurity advice; clinics and hospitals should consult a qualified cybersecurity professional and legal counsel to assess their specific risk and compliance posture.