Five Servers and a National Hospital: The AIIMS Ransomware Attack of 2022 and Health as Critical Infrastructure

B.A.P-I Retrospective, 2020 to 2024. This paper looks back at 2022 and the lesson it holds for the protection of India's critical infrastructure.

1. Introduction

On 23 November 2022 the All India Institute of Medical Sciences (AIIMS), New Delhi, reported a cyber attack on its servers. The National Informatics Centre (NIC) said that its e-Hospital service, which AIIMS uses, was down, and by the evening all services, including the smart laboratory, were being run manually; the hospital reported the incident to the Delhi Police, and CERT-In and NIC began helping to restore digital services (The Tribune, 2022, Nov. 24). For about two weeks the country's premier public hospital ran registration, admissions, laboratories and records by hand, while continuing to treat its patients.

This case study reconstructs the incident from what was officially stated in Parliament and by the hospital, the government and the police, sets out the government's response and the recovery that followed, and asks why, nearly four years later, the episode should be read as an argument for treating hospitals and health data as critical information infrastructure.

2. The Official Account

The official account was placed before Parliament within a month. In a written reply in the Rajya Sabha on 16 December 2022, the Minister of State for Electronics and Information Technology stated that "5 servers of AIIMS were affected and approximately 1.3 Tera Bytes of data was encrypted", and that, according to a preliminary analysis, servers on the hospital's network had been compromised by unknown threat actors owing to improper network segmentation, which disrupted critical applications (The News Minute, 2022, Dec. 17). The same day the Minister of State for Health told the Lok Sabha that the five affected physical servers hosted NIC's e-Hospital application, that "No specific amount of ransom was demanded by the hackers", and that all e-Hospital data had been retrieved from an unaffected backup server and restored on new servers (The Tribune, 2022, Dec. 16). Health Ministry officials had earlier been reported as saying that the data on the five infiltrated servers had been retrieved and that the FIR indicated the attack had originated from China (Deccan Herald, 2022, Dec. 14).

A further Lok Sabha answer of 21 December 2022 recorded that a First Information Report had been registered with the Special Cell of the Delhi Police under Section 385 of the Indian Penal Code and Sections 66 and 66F of the Information Technology Act, and that the affected servers had been seized for investigation (Lok Sabha, 2022, Dec. 21). The invocation of Section 66F, the provision on cyber terrorism, showed how seriously the State regarded an attack on a national hospital. The official record also settled the most sensational claim in circulation: media reports had spoken of a ransom of about Rs 200 crore in cryptocurrency, but the Delhi Police stated that no such demand had been reported to them by the hospital (Khaleej Times, 2022, Nov. 28), and the Health Ministry confirmed to Parliament that no specific amount had been demanded (The Tribune, 2022, Dec. 16).

3. The Government's Response and the Recovery

The response combined forensic investigation, restoration and system hardening. CERT-In evaluated the incident and, with other agencies, advised remedial measures; AIIMS put in place endpoint hardening, firewall policies and network segmentation (The News Minute, 2022, Dec. 17). CERT-In sent the Ministry of Health and Family Welfare a special advisory on security practices to enhance the resilience of health sector entities, with a request that it be passed to authorised medical care providers and that priority audits be arranged through CERT-In-empanelled auditors (Lok Sabha, 2022, Dec. 21). CERT-In had also empanelled auditing organisations for vulnerability assessment and penetration testing of public service systems, including the Ayushman Bharat Digital Mission (The Tribune, 2022, Dec. 16).

Recovery was steady. By the start of December the hospital reported that it had recovered the corrupted databases, and it was sanitising its network before bringing services back online (Healthcare IT News, 2022, Dec. 1). Most e-Hospital functions, including registration, appointments, admission and discharge, were restored about two weeks after the attack, and during the outage the hospital built an in-house dashboard for real-time emergency bed availability (The Tribune, 2022, Dec. 16). The improvement in defences was demonstrated within months: in June 2023 AIIMS announced that its cyber security systems had detected and blocked a malware attack on its e-Hospital services, which remained secure and functioning normally, and the Minister of State for Electronics and Information Technology confirmed that there had been no breach (Business Standard, 2023, Jun. 6).

4. The Impact on Hospital Services

The clinical disruption was nonetheless real, and it is the part of the record from which the deepest lessons come. The Delhi Police stated that outpatient and inpatient digital services, including the smart laboratory, billing, report generation and the appointment system, had been affected, and that outpatient registration, sample collection, admission, discharge and transfer were being done manually (Khaleej Times, 2022, Nov. 28). Day-to-day work, surgeries and record-keeping continued by hand (The Tribune, 2022, Dec. 16). The hospital never closed its doors. What it lost, for a fortnight, was the information layer on which modern clinical throughput depends, and the speed of everything that rests on it.

5. Why Hospitals Are Critical Information Infrastructure

India's framework for the protection of critical information infrastructure rests on the National Critical Information Infrastructure Protection Centre (NCIIPC), created under Section 70A of the Information Technology Act through a notification of 16 January 2014 (NCIIPC, n.d.). The Centre provides threat intelligence and advisories to organisations with critical information infrastructure or protected systems, and follows up on compliance with the 2018 rules on information security practices for protected systems (PIB, 2025, Mar. 28). In the AIIMS case the official answers describe a hospital that managed its own systems, with sector-wide action taken through an advisory routed via the Health Ministry (Lok Sabha, 2022, Dec. 21). The reform opportunity is to bring the largest hospitals within the more demanding protected systems regime.

The case for doing so is strong. A national referral hospital is infrastructure in the full sense: its disruption slows emergency care and referral chains across states, and its records hold the medical histories of very large numbers of citizens. The threat environment has grown steadily, with CERT-In tracking 13,91,457 cyber security incidents in 2022, 15,92,917 in 2023 and 20,41,360 in 2024 (PIB, 2025, Mar. 28). The Digital Personal Data Protection Rules notified in November 2025, which bring the 2023 Act into full effect over an 18-month phased timeline, now oblige data fiduciaries to inform affected individuals of a breach in plain language (PIB, 2025, Nov. 14). That is an important privacy safeguard; the complementary step is a continuity regime for clinical systems. If critical infrastructure protection is the third dimension of national security, alongside internal and external security, then the digital spine of an apex hospital belongs within it (Dash, 2025, Jan. 30).

6. Designate, Segment and Rehearse: Recommendations

Three recommendations follow, each building on steps the government has already taken. First, apex and referral hospitals, together with the national digital health platforms they connect to, should be formally identified as critical information infrastructure, bringing them within the protected systems regime and the direct oversight of NCIIPC. Second, the remedy AIIMS adopted in 2022 should become a national standard: clinical, laboratory and administrative networks should be segmented, with offline backups of the kind that allowed AIIMS to restore its e-Hospital data, tested regularly by actual restoration. Third, every major hospital should hold and rehearse a manual operations plan, with paper workflows, emergency bed tracking of the kind AIIMS built in-house and a communications protocol, so that the fortnight AIIMS managed in 2022 becomes a drill any hospital can run from the first hour.

AIIMS kept its doors open because its doctors, nurses and technical teams adapted at once, and the national agencies helped it recover its data and harden its systems. The task now is to make that resilience systemic, so that every major hospital in India is designed to withstand such an attack from the outset.