Cyberattacks on Indian Hospitals: Ransomware Lessons from the AIIMS Delhi Attack

Hero Summary

Hospitals are attractive ransomware targets because downtime directly affects patient care and the data they hold is highly sensitive. The clearest Indian example is the attack on the All India Institute of Medical Sciences (AIIMS), Delhi, which began on November 23, 2022: the hospital's e-Hospital servers, including backup servers, were affected, and the institute ran admissions, appointments, and sample collection manually for more than a week while systems were restored. This guide explains what the incident shows, why healthcare is targeted, and a practical checklist for hospital resilience.

Executive Summary

A hospital cannot simply pause when its systems go down. Patient records, scheduling, laboratory and imaging workflows, and billing usually depend on connected systems, so an attack that encrypts or disables them forces staff onto manual processes while patients are still being treated. This guide summarizes the AIIMS Delhi incident from public reporting, explains why healthcare organizations are targeted, and sets out defensive measures: resilient and tested backups, network segmentation, strong authentication, monitoring, vulnerability testing, a rehearsed incident plan, and attention to patient data protection obligations.

Why hospitals are targeted {#why}

• Downtime is dangerous, which creates pressure to restore quickly. Attackers know that a hospital cannot tolerate extended outages.
• Patient data is sensitive and valuable. Medical records combine identity, financial, and health information.
• Complex, interconnected environments. Hospitals run clinical systems, medical devices, administrative systems, and third-party platforms, often including older systems that are hard to patch.
• A wide user base. Large numbers of clinicians, administrators, and visitors mean many potential phishing targets and access points.
• Dependence on vendors and shared platforms, where one compromised provider can affect many facilities.

Case study: AIIMS Delhi (November 2022) {#aiims}

On the morning of November 23, 2022, AIIMS Delhi's e-Hospital system, run by the National Informatics Centre, went down. Reporting at the time said the primary and first backup servers were affected, and that the institute's team was treating it as a suspected ransomware attack. Admission, appointments, report generation, laboratory systems, discharge, and billing were affected.

Outpatient departments and sample collection continued by hand, and AIIMS issued procedures to handle admission, discharge, and transfer manually while the system was down. Reports described the servers still being out of action on the fourth, sixth, and seventh days, with data restoration and server cleaning taking time because of the volume of data and number of servers involved. Reporting on whether a ransom was demanded, and in what amount, was inconsistent, and this guide does not rely on any particular figure. Delhi Police registered a case, and multiple government agencies, including CERT-In, investigated.

Public sources do not give a confirmed date for full restoration of digital services, so this guide does not state a total outage length.

What the incident shows {#shows}

• Backups only help if they are separate and tested. An attack that reaches backup systems turns a recoverable incident into a prolonged one.
• Manual downtime procedures matter. The institution kept essential care running because staff could revert to paper-based processes.
• Recovery takes time when large volumes of data and many servers must be cleaned and verified before returning to service.
• A single platform can be a single point of failure for a very large institution.
• Patients without existing digital identifiers faced additional difficulty during the outage, showing that resilience planning should consider how every patient group is served when systems are down.

Data protection obligations {#obligations}

A healthcare breach is also a data protection event. Indian hospitals handle personal data covered by India's Digital Personal Data Protection Act, and hospitals that serve international patients or partners may also be subject to HIPAA or GDPR. CERT-In's April 2022 directions additionally require covered entities to report specified cyber incidents within six hours of noticing them and to retain logs for 180 days. See What Is DPDP? and the Hospital Compliance Guide.

A hospital resilience checklist {#checklist}

1. Keep backups offline or immutable, and test restores regularly — including a full restore of critical clinical systems, not just a file.
2. Segment the network so clinical systems, medical devices, administrative systems, and guest networks cannot reach each other freely.
3. Require multi-factor authentication for remote access, administrator accounts, and email.
4. Patch and manage vulnerabilities, and compensate with isolation where legacy systems cannot be updated.
5. Monitor 24x7. Early detection of unusual activity can stop an intrusion before encryption starts.
6. Test with VAPT on internet-facing systems, internal networks, and clinical applications.
7. Train staff against phishing, which remains a common way in. See Phishing Attacks: Types, Warning Signs & Prevention.
8. Maintain and rehearse a downtime and incident-response plan covering clinical continuity, communications, regulator and CERT-In reporting, and recovery priorities.
9. Assess vendors that host or connect to hospital systems.

For a wider look at ransomware itself, see the Ransomware Protection Guide.

How Threat ResQ fits {#threat-resq-fit}

• SOC+, Threat ResQ's managed detection and response platform, provides 24x7 monitoring and alert triage by a live analyst team, with correlated detection across endpoint, network, and identity signal.
• TRISA and its TRAP simulation capability address phishing awareness and human risk.
• PrivacyIQ, Threat ResQ's privacy management platform, provides a technical view of privacy posture and DPDP readiness. It is not a certifying authority and does not grant or imply a "DPDP compliant" status.
• The VAPT service covers vulnerability assessment and penetration testing, delivered in collaboration with a CERT-In empanelled security firm, and the Incident Response service supports response when an incident occurs.

FAQ {#faq}

What happened in the AIIMS Delhi cyberattack? On November 23, 2022, AIIMS Delhi's e-Hospital servers went down in what was treated as a suspected ransomware attack. Primary and backup servers were affected, and the hospital ran admissions, appointments, and sample collection manually for more than a week while systems were restored.

Why are hospitals targeted by ransomware? Because downtime directly affects patient care, creating pressure to restore quickly, and because medical records are sensitive and valuable. Hospitals also run complex, interconnected systems that include older equipment that is difficult to patch.

How can a hospital prepare for a ransomware attack? Keep tested offline or immutable backups, segment the network, enforce multi-factor authentication, patch and test regularly, monitor continuously, train staff, and rehearse a downtime and incident-response plan that includes regulator and CERT-In reporting.

Do Indian hospitals have to report cyber incidents? CERT-In's April 2022 directions require covered entities to report specified cyber incidents to CERT-In within six hours of noticing them. Hospitals should also confirm other reporting obligations that apply to them.

What data protection laws apply to hospitals in India? India's Digital Personal Data Protection Act applies to personal data processing, and hospitals serving international patients or partners may also be subject to HIPAA or GDPR. Obligations depend on the facts, so confirm with qualified advisers.