Cyberattack Catastrophe: How Hackers Can Endanger Human Lives?

This article introduces a research series by CA Mayur Joshi, a forensic accountant and member of EC-Council’s Global Advisory Board for Computer Forensics, on how cyberattacks have moved from stealing data to threatening physical safety. It does two jobs: it sets out the ways a cyberattack can turn into physical harm, and it maps the series so that each article can be read for its own contribution.

Four ways a cyberattack becomes physical harm

Across the incidents covered in this series, harm to people follows one of four routes. Most real incidents combine more than one.

1. Manipulating systems that control physical processes

Industrial control systems open valves, run motors and dose chemicals. If an attacker changes their commands, equipment can be damaged or made unsafe. Stuxnet, discovered in 2010, is the clearest proof: technical analysis by Symantec (W32.Stuxnet Dossier) and by industrial security researcher Ralph Langner (To Kill a Centrifuge) showed it reprogrammed Siemens controllers to damage uranium-enrichment centrifuges at Natanz in Iran while hiding the changes from operators. Stuxnet was built to destroy equipment, not to kill, but it showed that code can cause physical destruction. In December 2015, attackers used remote access to the control systems of three Ukrainian power distribution companies to cut electricity to about 225,000 customers (CISA alert IR-ALERT-H-16-056-01). In 2017, attackers went further and targeted the safety system of a Middle East petrochemical plant, the controllers designed to shut it down before an explosion or toxic release; the FBI said the attack could have caused loss of life (FBI notice on TRITON). Read more: industrial control systems, the Triton attack on safety systems, nuclear facilities and power grids.

2. Denying essential services

Ransomware does not need to touch a machine that harms anyone. By locking hospitals, pipelines or city services out of their own systems, it delays care, fuel and emergency response. The WannaCry outbreak of 2017 affected at least 81 NHS trusts in England and led to an estimated 19,000 cancelled appointments (National Audit Office). In 2021, the Colonial Pipeline company shut down its fuel pipeline for several days after a ransomware attack on its business network (summary). Read more: ransomware attacks on hospitals and smart cities.

3. Cascading failures across dependent systems

Infrastructure depends on other infrastructure. Water treatment needs electricity, hospitals need water and power, and traffic control needs both. An attack on one system can therefore cause harm in another that was never touched. This is why the power grid article treats blackouts as a multiplier for risks in water, transport and healthcare.

4. Compromising devices people rely on or carry

Connected medical devices and vehicles bring the risk closest to individuals. In 2008, academic researchers showed at the IEEE Symposium on Security and Privacy that an implantable cardiac defibrillator could be reprogrammed wirelessly in the lab (Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses). In 2017, US authorities announced firmware updates for Abbott (formerly St. Jude Medical) pacemakers after vulnerabilities were found that could let a nearby attacker change settings or drain the battery (CISA advisory ICSMA-17-241-01). In June 2019, Medtronic recalled MiniMed 508 insulin pumps because an unauthorised person nearby could potentially change settings or control insulin delivery (FDA recall record). In 2015, security researchers remotely took control of a Jeep Cherokee’s steering and brakes in a controlled test (Wired), and Fiat Chrysler recalled about 1.4 million vehicles to fix the flaw (ABC7). Read more: pacemakers and connected cars.

What the evidence shows, and what it does not

Discussions of this subject often blur three different things. Keeping them apart is the most useful way to judge any claim:

• Demonstrated by researchers: attacks shown to be possible in controlled conditions, such as the pacemaker, insulin pump, Jeep and drone GPS spoofing studies. They prove capability, not real-world harm.
• Real attacks that caused disruption or damage: Stuxnet, the Ukrainian grid attacks, WannaCry, Colonial Pipeline and hospital ransomware attacks. They prove that attackers act on these capabilities.
• Suspected or contested harm: cases where a link to injury or death has been alleged but not proven.

Two well-known cases belong in the third group:

• Düsseldorf, 2020. A woman died after being redirected from Düsseldorf University Hospital during a ransomware attack. Prosecutors investigated but concluded she would likely have died anyway, so the attack-related delay was not considered the decisive cause of death (CCDCOE Cyber Law Toolkit). Separately, a University of Minnesota working paper estimated that ransomware attacks were associated with 42 to 67 Medicare patient deaths in US hospitals between 2016 and 2021 (McGlave, Neprash and Nikpay). The study measures a statistical association across many hospitals; it does not attribute any individual death.
• Oldsmar, Florida, 2021. Authorities reported that an unidentified actor accessed the SCADA system of the city’s water treatment plant and tried to raise the level of sodium hydroxide, and that an operator reversed the change (CISA and FBI advisory AA21-042A). In 2023, the city’s former manager said the incident was likely employee error rather than a hack; no official investigative findings have been published (Tampa Bay Times). Oldsmar is best treated as an unresolved case, not as proof of an attempted poisoning. See water supply attacks for the confirmed attacks on water systems.

A note on the 2024 Lebanon pager explosions

The pager and radio explosions in Lebanon on 17 and 18 September 2024 are sometimes described as a cyberattack, and an earlier version of this article raised that possibility. Lebanon’s health minister reported 12 people killed in the pager blasts, including two children, and about 2,800 injured (Naharnet), and Israel’s prime minister later said he had approved the operation (Khaleej Times). Experts, however, rejected the idea that hackers made the devices explode; reporting points to explosives built in during manufacturing (Logically Facts). Because it was a hardware supply-chain operation rather than an attack carried out through code, it is not part of this series. Our separate analysis is here: Pager Attack: How Communication Devices Can Be Weaponized.

The series: what each article covers

Each article has its own scope and sources. Read them in this order for a complete picture, or go straight to the system that matters to you.

1. Cyber Attacks on Power Grids: Alarming Risk of Cascading Failures: how grid attacks work, the 2015 and 2016 Ukrainian blackouts, and why power failures cascade into every other system.
2. How Water Supply Attacks Endanger Communities?: how water systems are reached, government warnings about state-linked actors, and why small utilities are exposed.
3. How Cyber Attacks on Industrial Control Systems Can Endanger Lives?: the control systems behind factories, pipelines and plants, and defences such as segmentation and one-way gateways.
4. Cyberattacks on Nuclear Facilities: Stuxnet, Kudankulam and the Limits of Air Gaps: Stuxnet, the Davis-Besse worm and the Kudankulam malware, and why reactor safety does not depend on networked computers.
5. How Attacks on Transportation Systems Can Endanger Human Lives: rail, aviation, shipping and city transport, including NotPetya and the New York MTA breach.
6. Cyber Attacks on Connected Cars: how vehicle software can be reached remotely and what the Jeep research changed.
7. Cyberattacks on Pacemakers: Could Hackers Control Life-Saving Medical Devices?: wireless implants, the 2017 firmware update, and what researchers have and have not shown.
8. Ransomware Attacks on Hospitals: How Healthcare Cyberattacks Put Patients at Risk: the most common real route from a cyberattack to patient harm, and the evidence on deaths.
9. Cybersecurity Risks in Smart Cities: When Connected Infrastructure Fails: how city-scale connection concentrates these risks, with the Dallas and Atlanta incidents.
10. French Supermarket Refrigeration Cyberattack: How Hacking the Cold Chain Can Endanger Lives: the October 2026 attack that heated refrigeration in hundreds of French supermarkets, and how cold-chain tampering can lead to fire, food poisoning and spoiled medicines.

Key takeaways

• The capability to cause physical harm through cyberattacks is proven; individual deaths caused by cyberattacks are not.
• The most common real-world route to harm today is disruption of essential services, especially ransomware against hospitals.
• Dependencies between systems mean an attack on one can endanger people relying on another.
• Connected devices and their supply chains bring the risk closest to individuals.
• French Supermarket Refrigeration Cyberattack: How Hacking the Cold Chain Can Endanger Lives
• Claims should be judged by the evidence behind them: demonstrated, disruptive, or suspected.

Frequently asked questions

Can a cyberattack kill people?

A cyberattack can create conditions that endanger life, for example by delaying hospital care, cutting power or interfering with control systems. Research on US hospitals has linked ransomware attacks to higher in-hospital mortality, but no individual death has been conclusively proven to have been caused by a cyberattack.

Has anyone died because of a hospital cyberattack?

The most cited case is Düsseldorf in 2020, where a patient died after being redirected during a ransomware attack. German prosecutors investigated but concluded the delay was not the decisive cause of her death. A University of Minnesota working paper estimated ransomware attacks were associated with 42 to 67 Medicare patient deaths in the US between 2016 and 2021, as a statistical estimate rather than attribution of individual deaths.

Were the Lebanon pager explosions a cyberattack?

Not in the usual sense. Experts rejected the theory that hackers made the batteries explode. Reporting indicates explosives were placed in the pagers during manufacturing and detonated by a received message, making it a supply-chain compromise with a remote trigger. Israel’s prime minister said in November 2024 that he approved the operation.

What happened at the Oldsmar water treatment plant?

In February 2021, authorities reported that an unidentified actor accessed the SCADA system of Oldsmar, Florida’s water plant and tried to raise sodium hydroxide levels, and that an operator reversed it. In 2023 the city’s former manager said it was likely employee error; no official findings have been published.

Which systems are most at risk from life-threatening cyberattacks?

Electricity grids, water and wastewater systems, transport networks, industrial control systems, hospitals and connected medical devices, because they control physical processes or services people depend on to stay safe.

Last reviewed: 22 October 2026. This article is research and analysis based on publicly documented incidents, government advisories and published security research, linked inline.