Phobos encrypts the Oracle database behind a hospital HIS

The client is a secondary hospital whose HIS, LIS and electronic medical records share one Oracle instance on a physical server in the in-house data centre. To let external vendors maintain the system remotely, a remote desktop port had long been open on the firewall, with the account shared between the hospital and two system integrators.

The incident occurred on a Friday night. On Saturday morning duty staff found the outpatient registration system unable to reach the database: data files, control files and some archive logs carried a long appended suffix containing a contact email, and ransom note text files had appeared on the desktop and in several directories. A reporting replica server was affected at the same time.

The most recent full backup was a cold backup written to a local backup disk four days earlier. That disk was mounted during the incident and some backup files were encrypted — but the separate disk holding archive logs was largely intact, because the encryptor had not traversed that path.

Outpatient services switched to manual registration and billing on Saturday morning, concentrating pressure on windows and the pharmacy, and the hospital asked for registration and billing capability back the same day.

Because clinical services are time-critical, the work followed one order: get outpatient services running first, backfill history afterwards.

• Containment and evidence. The affected server and the replica were isolated, memory and disk images preserved, and firewall, RDP logon and Oracle alert logs collected.
• Family and behaviour. The suffix structure and note format identified a Phobos variant outside the coverage of the July 2025 official decryptor, ruling out decryption. Testing showed this build encrypted large files in fixed regions, concentrating damage to DBF files in the header and leading section.
• Prioritization. With the hospital's information department, the order was set as outpatient registration and billing, pharmacy and inventory, inpatient and medical records, then research and statistics.
• Recovery. Using the intact archive logs as the backbone, together with the unencrypted portion of the four-day-old cold backup, the instance was rebuilt in an isolated environment and media recovery performed. For tablespaces missing from the backup, file-level repair extracted untouched data blocks from the encrypted data files.
• Parallel verification. The information department and registration staff sampled each module against real workflows before anything was cut over to production.