Salvage ops continue, servers may take 3-4 days to revive, says AIIMS

The hospital in a statement said the sanitisation operation was taking time due to the quantum of data involved.

Officials at the All India Institute of Medical Sciences (AIIMS) in Delhi, who are grappling with a six-day long server outage that has nearly immobilised the facility’s out-patient department and halted digital services, on Monday said they expect online facilities to be restored in “three or four days”.

The main entrance to the OPD at AIIMS, New Delhi. (File)

“Digital services will be restored in phases. Currently, all operations are continuing manually. Antivirus solutions have been installed in over 1,000 systems, out of around 5,500 systems. A complete sanitisation of the network is in progress,” a senior official from AIIMS said, adding that security agencies have managed to restore the National Informatics Centre e-Hospital database and application servers.

The hospital in a statement said the sanitisation operation was taking time due to the quantum of data involved.

“Data restoration and server cleaning is in progress and is taking some time due to the volume of data and large number of servers for the hospital services. Measures are being taken for cyber security,” said the statement issued on Monday evening.

The AIIMS statement came even amid media reports that attackers, who have locked away access to the hospital’s primary server, demanded ₹200 crore in cryptocurrency as a ransom payment. However, hospital officials did not confirm these reports. The Delhi Police, for its part, in a statement said, “No ransom demand as being quoted by certain sections of the media has been brought to notice by AIIMS authorities.”

Four physical servers, put in place to restore digital services, have also been scanned, said the senior official quoted above.

Around 7am on Wednesday, the primary and the first backup servers of AIIMS were corrupted and it was later confirmed to be a ransomware attack.

The suspected ransomware attack has meant that the patients and doctors are unable to access records or test reports.

In an incident report sent by medical director Dr M Srinivas to the Union ministry of health and family welfare last week, the hospital said the first call received at the AIIMS computer facility was from the emergency lab, complaining that reports in the NIC laboratory system were inaccessible.

Thereafter, similar reports were received from the billing section and other areas. At 8am, the outpatient department (OPD) counters also reported the same error.

The Delhi Police’s Intelligence Fusion and Strategic Operations (IFSO) cell filed an FIR invoking sections of cyber terrorism (IT Act, section 66F) against unknown persons, while teams from NIC and Computer Emergency Response Team (CERT-In) have been attempting to restore the network, the hospital till late Monday evening was operating on manual mode.

On Friday, the National Investigation Agency (NIA) was also roped in to probe the hacking.

Doctors at AIIMS said on Monday that while the administration is working on a systematic, colour-coded form system to differentiate patient appointments, tests, admissions and surgeries, the ad-hoc arrangement is delaying services and leading to long queues in the main hospital as well as its centres.

“The biggest problem is accessing patients’ history. We are currently relying on manual backups, but that is taking a lot of time. In each form we have to mention the patient’s unique health ID and the doctors and administrative staff have to cross-reference the past records based on their ID. This process used to take a few seconds on the computers, but now it takes time,” a resident doctor at the hospital said.

The worst-impacted by the system crash are outstation patients who were given appointments weeks in advance and came to Delhi with no information about the outage.

“I had an appointment with a doctor for November 25 and had booked my return tickets for November 27. But since my case is not urgent, doctors have asked me to wait two more weeks. If I had a little clarity of whether this problem is a temporary one or will require more time, I would be in a better position to plan my stay,” said Atul Mishra, who is scheduled to get a hernia surgery in the premier hospital.