Key points
- Ransomware endangers patients mainly by delaying care: hospitals lose records and test results, postpone operations and divert ambulances.
- In the Düsseldorf case of 2020, prosecutors concluded the attack-related delay was not the decisive cause of the patient’s death; the case shows the risk, not a proven fatality.
- A University of Minnesota working paper estimated ransomware attacks were associated with 42 to 67 Medicare patient deaths in the US between 2016 and 2021.
What this article covers: how ransomware against hospitals and their suppliers affects patient safety, the main documented cases, and what the research shows about deaths.
Its place in the series: the most common real-world route from a cyberattack to patient harm, focused on hospital systems rather than individual medical devices.
Ransomware is the cyberattack most likely to reach patients today. It does not need to touch a medical device. By encrypting the systems a hospital runs on (patient records, scheduling, imaging, laboratory results and communications), it can slow or stop care for everyone who arrives while the systems are down.
How ransomware disrupts patient care
A hospital under a ransomware attack typically loses electronic health records, test results, imaging systems and internal messaging at the same time. Staff fall back on paper, emergency departments may divert ambulances to other hospitals, and planned operations are postponed. The danger to patients comes from delay and from working without information, not from the malware itself.
Düsseldorf, 2020: the case most often cited, and what investigators concluded
In September 2020, the DoppelPaymer ransomware disabled about 30 servers at Düsseldorf University Hospital through a known vulnerability in Citrix VPN software. The hospital stopped admitting new emergency patients. On 11 September, a woman with an aortic aneurysm was taken instead to a hospital in Wuppertal, about 32 km away, and died shortly after arriving (CCDCOE Cyber Law Toolkit).
German prosecutors opened a negligent homicide investigation against the attackers. After two months they concluded that the patient was so ill she would likely have died anyway, so the delay caused by the attack was not considered the decisive cause of her death (CCDCOE). The case is evidence that ransomware forces hospitals to turn patients away. It is not proof that a cyberattack has killed someone.
WannaCry and the NHS, 2017
The WannaCry ransomware outbreak of 12 May 2017 was the largest cyberattack to affect the NHS in England. The National Audit Office found that at least 81 of 236 hospital trusts were affected, along with 603 primary care and other NHS organisations. NHS England estimated that more than 19,000 appointments were cancelled, and five accident and emergency departments diverted patients elsewhere (National Audit Office). The NAO report does not record any confirmed patient harm.
What the research says about patient deaths
Because individual cases are hard to prove, researchers have looked for patterns across many attacks. Economists at the University of Minnesota School of Public Health analysed Medicare data for US hospitals hit by ransomware between 2016 and 2021. They found that in-hospital mortality for Medicare patients admitted during an attack rose from about 3 in 100 to about 4 in 100, and estimated that the attacks were associated with between 42 and 67 Medicare patient deaths over the period (McGlave, Neprash and Nikpay, SSRN working paper). The authors describe the study as a working paper, and the estimate covers only Medicare patients (STAT).
Attacks on the companies hospitals depend on
Hospitals also depend on outside suppliers. The February 2024 ransomware attack on Change Healthcare, a UnitedHealth Group subsidiary that processes insurance claims and prescriptions, disrupted payments and pharmacy services across the United States, and the company later said the data of about 190 million people was affected (Healthcare Finance News). A single supplier can therefore become a point of failure for thousands of hospitals and pharmacies.
Reducing the risk
- Patch remote-access systems quickly. The Düsseldorf attack exploited a VPN vulnerability for which a fix was already available.
- Keep offline, tested backups of clinical systems so that records can be restored without paying a ransom.
- Plan for working without computers. Paper-based downtime procedures and ambulance diversion agreements decide how safely a hospital runs during an outage.
- Segment clinical networks so that medical devices and core clinical systems are not reachable from general office IT.
- Assess suppliers such as claims processors and software vendors, as the Change Healthcare attack showed.
Ransomware is one route by which cyberattacks reach patients. For attacks on the devices themselves, see cyberattacks on pacemakers; for how hospitals are exposed when electricity fails, see cyberattacks on power grids. The series overview sets out how these risks connect.
Frequently asked questions
Can a ransomware attack on a hospital kill patients?
It can put patients at risk by delaying care, diverting ambulances and cutting staff off from records. A University of Minnesota working paper estimated that ransomware attacks were associated with 42 to 67 Medicare patient deaths in US hospitals between 2016 and 2021. No individual death has been proven in court to have been caused by a cyberattack.
Did a ransomware attack kill a patient in Düsseldorf?
A patient died in September 2020 after being redirected from Düsseldorf University Hospital during a ransomware attack. Prosecutors investigated, but concluded she would likely have died anyway, so the delay was not considered the decisive cause of her death.
How did WannaCry affect the NHS?
WannaCry affected at least 81 of 236 NHS trusts in England and 603 other NHS organisations in May 2017. NHS England estimated more than 19,000 appointments were cancelled and five A&E departments diverted patients. The National Audit Office did not report confirmed patient harm.
How can hospitals protect themselves from ransomware?
By patching remote-access systems quickly, keeping offline tested backups, segmenting clinical networks, rehearsing paper-based downtime procedures and assessing the security of critical suppliers.
Last reviewed: 21 October 2026. This article is research and analysis based on publicly documented incidents, government advisories and published security research, linked inline.
