When Hospital Servers Go Down: What India's Real Cyberattacks Teach Us

On the night of June 10–11, 2025, two Delhi hospitals — Sant Parmanand Hospital in Civil Lines and NKS Super Speciality Hospital in Gulabi Bagh — had their servers hacked. Patient records, financial data, and administrative files were reportedly accessed, and NKS had to revert its entire OPD and IPD workflow to manual paper processes while systems were down. It was not the first time: AIIMS Delhi's landmark ransomware attack in November 2022 took servers offline for days and forced India's most prominent hospital to run registration, billing, and reports by hand. The World Economic Forum's 2026 Global Risk Report now ranks cybersecurity as India's number one national risk — ahead of economic downturn, climate disasters, and armed conflict. This post looks at what actually happens inside a hospital when its systems go down, and the specific security questions every facility should be asking its software vendor.

What "Servers Down" Actually Means Inside a Hospital

A cyberattack on a hospital is usually described in IT language — servers, ransomware, breach. Here is what it means at the front desk on the morning after:

• Registration reverts to paper. New patients get handwritten slips. Returning patients become strangers — their history, allergies, and past prescriptions are locked inside systems nobody can open.
• Billing runs blind. Charges get noted in registers to be entered "later." Some of them will never be entered. Discharges slow to a crawl because nobody can compute a final bill.
• Lab and pharmacy disconnect. Orders travel on slips again. Results wait in printers. Dispensing happens against handwritten prescriptions with no stock deduction.
• Nobody knows what was taken. The deeper damage is invisible: patient medical records, contact details, and financial data may now be in someone else's hands. Under the DPDP Act, the hospital — not the hacker — owes patients and the Data Protection Board an account of what was exposed.

At AIIMS, this state lasted for days. At NKS, digital OPD and IPD workflows were disrupted overnight with no warning. Neither facility chose the timing. That is the defining feature of this risk: it arrives at 2 AM on a random Tuesday, and the hospital's readiness on that exact day is all that matters.

Why Hospitals Are Now a Preferred Target

Security researchers analysing Indian healthcare breaches point to a consistent pattern: weak security architecture, poor data governance, and systematic under-estimation of cyber risk. Hospitals combine three things attackers love:

1. Data that cannot be replaced. A stolen credit card gets cancelled; a medical history is permanent. Health records command a premium precisely because they cannot be reissued.
2. Zero tolerance for downtime. A hospital cannot simply close for a week while IT recovers — which is exactly what makes ransomware demands effective against them.
3. Thin IT defence. Most Indian hospitals under 200 beds have no dedicated security staff. Many still run aging on-premise servers, unpatched software, and shared logins — the same conditions the post-breach analyses keep finding.

The WEF ranking is worth sitting with: cybersecurity is now assessed as a larger risk to India than economic downturn. For a sector that holds the most sensitive personal data there is, "it won't happen to us" is no longer a plan.

The Five Questions to Ask Your Software Vendor

A hospital cannot out-build a determined attacker on its own. What it can do is choose software and vendors whose defaults are sound. These five questions separate real security postures from brochure claims:

1. Is patient data encrypted at rest and in transit — and with what? The honest answer names algorithms and versions. Softpital's cloud encrypts data at rest with AES-256 and in transit with TLS 1.3; self-hosted deployments use the same encryption with keys under the hospital's own control. A vendor who answers "yes, it's secure" without specifics has answered.

2. Who can see what, and can you prove it? Role-based access control limits the blast radius of any single compromised login — a receptionist's credentials should never unlock clinical records or financial exports. Softpital ships 168+ role permissions for exactly this reason. Equally important: audit trails logging every access and modification with user ID and timestamp, because after any incident, the first question is "what was touched?" — and a hospital without logs cannot answer it.

3. What happens to operations when systems are unreachable? Continuity is a security feature. Softpital's self-hosted deployment includes a 7-day offline JWT fallback — if connectivity fails, the facility keeps operating locally instead of reverting to paper. No architecture makes a hospital unbreachable, but the gap between "degraded" and "back to handwritten registers" is the gap NKS and AIIMS staff lived through.

4. Where are the backups, and when were they last tested? Ransomware's leverage is the absence of clean, recent, separately-stored backups. Cloud HMS shifts backup discipline to the vendor — ask for the schedule, retention, and restore-test cadence in writing. For self-hosted setups, ask who is responsible for backups in the contract, because "we assumed the vendor did it" is a sentence that appears in post-incident reports with depressing regularity.

5. What is the breach protocol — theirs and yours? Under the DPDP Act, a breach of patient data triggers notification duties to the Data Protection Board. Your vendor should be contractually obliged (via the Data Processing Agreement) to inform you of any incident affecting your data, fast enough for you to meet your own obligations. Our ABDM & DPDP compliance guide covers the DPA requirement in detail — a vendor who cannot sign one has told you what you need to know.

The Cloud vs. On-Premise Security Question, Honestly

The AIIMS and Delhi hospital incidents involved compromised institutional servers — which complicates the common instinct that "our data on our server" is automatically safer. On-premise means your security is as good as your own patching, your own firewall, and your own IT staff at 2 AM. Cloud means your security is as good as your vendor's — which, for a serious vendor, includes full-time security engineering no individual hospital could staff.

There is no universally right answer. Facilities with strict data-residency needs and real IT capability can run self-hosted well — Softpital supports it, encryption and offline fallback included. But a 50-bed hospital with no IT team choosing on-premise "for security" is usually choosing the opposite. The honest comparison is not cloud vs. on-premise; it is who patches, who monitors, and who answers the 2 AM call. Our cloud vs self-hosted guide walks through the full decision.

FAQ

Q: Have Indian hospitals actually been hit by cyberattacks? A: Yes, repeatedly. AIIMS Delhi's November 2022 ransomware attack took servers down for days and forced manual operations. In June 2025, Sant Parmanand Hospital and NKS Super Speciality Hospital in Delhi were hacked overnight, with patient records and financial data reportedly accessed and NKS reverting OPD and IPD workflows to paper. Security analysts consistently find Indian healthcare under-protected relative to the data it holds.

Q: What happens to a hospital when its management system goes down? A: Operations revert to paper within hours: handwritten registration, blind billing, disconnected lab and pharmacy, and no access to any patient's history. Discharges slow, charges go unrecorded, and — if data was accessed — the hospital faces DPDP Act breach-notification obligations it may struggle to meet without access logs.

Q: Why are hospitals targeted by hackers? A: Medical records are permanently valuable (they cannot be cancelled like a card), hospitals cannot tolerate downtime (making ransom demands effective), and most facilities have thin IT defence — no security staff, aging servers, shared logins. That combination makes healthcare a preferred target, and the WEF's 2026 Global Risk Report ranks cybersecurity as India's top national risk.

Q: How should hospital software protect patient data? A: At minimum: encryption at rest (AES-256) and in transit (TLS 1.3), role-based access control so one compromised login cannot expose everything, complete audit trails of every access and change, tested backups stored separately from production, and a signed Data Processing Agreement covering breach notification. Vendors should answer each point specifically, not generically.

Q: Is cloud or on-premise hospital software more secure? A: Neither automatically. On-premise security depends on the hospital's own patching, monitoring, and IT staffing — which is where several real Indian incidents originated. Cloud shifts that burden to the vendor's full-time security team. Facilities with genuine IT capability and data-residency needs can run self-hosted well; facilities without IT staff usually should not.

Q: What does the DPDP Act require after a hospital data breach? A: The hospital, as data fiduciary, must notify the Data Protection Board of India within the prescribed timeframe and be able to account for what was exposed — which requires access logs that survive the incident. Cloud HMS vendors must be bound by a Data Processing Agreement to report incidents affecting hospital data promptly.

The Bottom Line

AIIMS, Sant Parmanand, and NKS were not careless outliers — they were ordinary institutions on an ordinary night, and their experience is now the documented base case for what a cyberattack does to a running hospital. The lesson is not fear; it is specificity. Ask your vendor the five questions — encryption, access control, continuity, backups, breach protocol — and accept only specific answers. Book a demo and put them to us first; we will answer with algorithm names, permission counts, and contract clauses, because on this topic, vagueness is the red flag.

Sources: CM-Alliance — AIIMS ransomware attack analysis · VAR India — Healthcare data breaches warning · Eventus Security — Recent cyber attacks in India