Ransomware's human toll: hospital patients and owners who broke down

Ransomware is usually described in numbers: a demand in bitcoin, a count of encrypted servers, a bill for the clean-up. Behind those figures are a nurse reaching for a scanner that no longer works, a patient waiting for a blood result that never arrives, and a business owner lying awake asking whether the attack was their fault. This article follows several well-documented cases and one major research study, and it is careful about what is proven, what is estimated and what is still only an allegation.

What ransomware is and how it reaches a hospital

The US cyber agency CISA describes ransomware as a form of malware designed to encrypt files on a device, making them and the systems that rely on them unusable. The criminals then demand payment in exchange for decryption. CISA adds that attackers have increasingly copied the victim's data first and threatened to publish it, a combination it calls double extortion.

A hospital is not a normal office. Almost every step of care now passes through software: the electronic health record, the system that orders blood tests and returns the results, the barcode scanner that checks a medicine against a patient, the phone system, the scheduling tool. When those systems are encrypted or switched off to stop the spread, staff do not simply work slower. They lose the safety checks that the software performed for them.

Criminals know this. Josh Corman, a cybersecurity expert quoted by NPR, said ransom crews regard hospitals as perfect prey because "they have terrible security and they'll pay". According to the FBI's internet crime report, as summarised by NPR, the health sector suffered the largest share of ransomware attacks among the 16 critical infrastructure sectors in 2023. Voice of America, citing the security company Emsisoft, reported that 46 hospital systems with a total of 141 hospitals in the United States were affected by ransomware in 2023.

Düsseldorf 2020: the first death investigated as a ransomware homicide

On the night of 9 September 2020, ransomware hit Düsseldorf University Hospital, scrambling data and making computer systems unusable, the BBC reported. A woman who needed scheduled, life-saving treatment could not be admitted and was transferred to a hospital in Wuppertal, about 30 km away. She died. Cologne prosecutors opened a negligent homicide investigation, and Ciaran Martin, the former head of the UK's National Cyber Security Centre, said that if the link were confirmed it would be "the first known case of a death directly linked to a cyber-attack".

An academic journal, Computer Fraud & Security, later reported that the attack was believed to involve the DoppelPaymer malware, that the malware reached 30 of the hospital's servers, and that a delay of about an hour was believed to have contributed to the woman's death. The same article reported that the criminals had been aiming at Heinrich Heine University, to which the hospital is affiliated. A ransom note on one server was addressed to the university. When police contacted the attackers and explained that a hospital had been hit, they handed over a decryption key and made no further demand, and the hospital said systems were coming back online a week later.

What is established here: the attack happened, the hospital could not take the patient, and prosecutors investigated. What the sources I read do not give is a final legal finding on cause. Even Reuters, writing years later, noted that "direct causation can be difficult to establish" in cases like this.

London 2024: Synnovis and a confirmed contributing factor

On 3 June 2024 a ransomware attack hit Synnovis, a company that runs pathology laboratories for NHS trusts and GP services in south-east London. The BBC reported that more than 10,000 appointments were cancelled at the two worst-affected trusts and that many GP practices could not order blood tests. The Health Service Journal, quoted by the BBC, counted nearly 600 incidents linked to the attack, with patient care suffering in 170 of them: one case of severe harm, 14 of moderate harm and the rest of low harm.

In June 2025 King's College Hospital NHS Foundation Trust confirmed that a patient had "died unexpectedly" and that a patient safety investigation found several contributing factors, including "a long wait for a blood test result due to the cyber-attack impacting pathology services". The trust said it had met the family and shared the findings, and would not give the date or the person's age. Reuters called it one of the first confirmations of a death tied to hacking activity. Synnovis's chief executive said the company was "deeply saddened".

This is the clearest case in this article for a careful reason: a hospital trust itself, after a formal review, named the attack as one contributing factor among others. It does not say the attack was the only cause, and nobody should write it that way. The Qilin group, which was behind the attack, told the BBC it was sorry for the harm but was "not to blame". Reuters reported that media accounts put the ransom demand at $50 million, that Synnovis did not pay, and that the stolen data was later published. Reuters added that, in a filing, Synnovis said the hack had led to more than 32 million pounds in costs.

Ascension 2024: what nurses and doctors said happened

On 8 May 2024 a ransomware attack hit Ascension, a Catholic health system with 140 hospitals in at least 10 states. NPR, with KFF Health News and Michigan Public, spoke to more than a dozen doctors and nurses. They described delayed or lost lab results, medication errors and missing safety checks. Electronic records were restored across the network on 14 June, according to Ascension.

Several of the accounts were about near misses. Marvin Ruckle, a neonatal intensive care nurse in Wichita, Kansas, said confusing paperwork nearly led him to give a baby the wrong dose of a narcotic. Lisa Watson, an intensive care nurse in the same city, said she nearly gave the wrong medicine to a critically ill patient because she could not scan it as usual: "My patient probably would have passed away had I not caught it." An emergency room doctor in Detroit said a patient was given a dangerous narcotic intended for someone else, stopped breathing properly and had to be put on a ventilator. An ER nurse said a woman with low blood sugar went into cardiac arrest and died after staff waited four hours for lab results that never came.

These are clinicians' accounts. The reporters said they could not review patient records to verify them because of privacy law, and Ascension declined to answer questions about the claims, saying it was confident its providers continued to give quality care. The honest reading is that the NPR report documents what staff say they saw, it does not prove that the attack caused a particular death, and it is consistent with the pattern seen elsewhere.

A lawsuit that is still an allegation: Springhill Medical Center

CBS News reported on a lawsuit by Teiranni Kidd, whose daughter Nicko was born at Springhill Medical Center in Alabama on 17 July 2019, during a ransomware attack on the hospital. The suit claims that failed electronic devices meant her labor and delivery could not be monitored properly, and that the hospital did not tell her how serious the attack was. The baby was left with severe brain injuries and died at nine months after months of intensive care at another hospital.

This is an allegation in litigation, and it should be read as one. Springhill denied wrongdoing and argued that it had no legal duty under Alabama law to give Kidd details of the attack. It said the delivering doctor knew about the system outage. The doctor and her medical group denied that she did anything that harmed the child. The sources I read do not report a court ruling on the facts, so nothing here should be read as a finding.

How many deaths? What is proven and what is estimated

People often ask for a single number, and there is no honest one. Voice of America cited University of Minnesota School of Public Health researchers who estimated that ransomware attacks killed between 42 and 67 Medicare patients from 2016 to 2021. That is a statistical estimate among hospitalised patients. It is not a list of individual deaths each proven to have been caused by an attack. NPR separately cited the same school as finding that patients in hospital face a greater likelihood of death during a cyberattack.

Case	What is documented	Status of the claim
Düsseldorf, Sept 2020	Hospital systems down, patient transferred about 30 km and died	Negligent homicide investigation opened; no final finding in the sources read
Synnovis / King's, June 2024	Trust review lists a long wait for a blood result as one contributing factor in one death	Confirmed by the trust as a contributing factor, not the sole cause
Ascension, May 2024	Clinicians describe near misses, a medication error and a death after a four-hour lab wait	Staff accounts; records not verified by reporters; Ascension says care stayed safe
Springhill, July 2019	Lawsuit says monitoring in delivery was reduced; baby later died	Allegation in a lawsuit; denied by hospital and doctor
Minnesota study, 2016 to 2021	42 to 67 Medicare deaths estimated across US attacks	Statistical estimate, not individually proven cases

The small business owner: what the RUSI study found

Hospitals get the headlines. Owners of small firms often face the same attack alone. The Royal United Services Institute (RUSI), a UK research institute funded for this work by the National Cyber Security Centre, published a 2024 study based on 42 semi-structured interviews with victims of ransomware and with experts from the response industry. It is one of the few studies to ask what attacks do to the people inside the organisation.

Its findings are sobering and also reassuring in places. Interviewees described shame and self-blame. One person from a charity said, "we all blame ourselves". Others said the attack made them feel they had failed, or made them doubt everything they had built and whether they had run the business properly. A victim who strongly identified with their own business called the attack "actually really traumatic", and RUSI reports that it brought them close to suicide. RUSI researcher Pia Hüsch told a webinar, as The Record reported, that this "wasn't just the exception", though it "still remains relatively rare".

The study also recorded:

• An engineering company whose staff were under such pressure that the firm hired a post-traumatic stress disorder support team.
• Sleep deprivation, with employees falling asleep at the office or struggling to sleep at home. One victim said, "the fatigue on people was extreme".
• Fear that lingered after systems were fixed, such as one person saying there was "a bit of a PTSD about every time I walked through the office door". RUSI notes that this was a lay use of the term.

RUSI warns that the long-term psychological effect is even less likely to be noticed than the immediate stress, and The Record called this harm "significantly overlooked". Nothing in this section means every victim will suffer like this. It means that if you do, you are describing something researchers have recorded, and not a personal weakness.

When the servers are back, the harder part is often just starting: sleep that does not return, a dread of opening the door, and a sense that the work is never finished. That tiredness has a name and a recovery path, and it is the subject of our sister page on burnout after a crisis.

What the attack does to a mind, and why it passes for most people

Two points from the research are worth holding on to. First, the self-blame is nearly universal, and it is not evidence that you did something wrong. In the Düsseldorf case the attackers were reportedly after a different organisation entirely. Germany's cyber authority said the flaw they used had been the subject of a public warning since January. Criminal groups run these attacks as a business. Second, the attack is a crime committed against you, in the same way a burglary is, and you are the victim of it.

Warning signs that call for support rather than more willpower are plain: not sleeping for several nights, panic when a screen changes, being unable to switch off, thinking you have ruined everything, or any thought of harming yourself. These are not signs of weakness. If any of them apply, talk to your doctor, a counsellor, or someone you trust, and use the contacts at the end of this article.

What to do if ransomware hits you

Official guidance exists, and it is calm and practical. CISA's #StopRansomware guide, written with the FBI, NSA and MS-ISAC, tells organisations to work through the first steps in order. The steps below follow it.

1. Isolate affected machines at once. CISA says to take the affected network offline at the switch if several systems are hit, and if that is not possible, to unplug network cables or remove devices from Wi-Fi. For cloud resources, CISA suggests taking a snapshot of the volumes so there is a point-in-time copy for investigators.
2. Stop and breathe before you contact the attackers. Law enforcement agencies encourage victims not to pay, arguing it fuels organised crime, as the BBC noted. Security expert Ivan Markovic told Voice of America that once someone has been in your system, you must consider that everything has been compromised. In the US, payments can also raise sanctions problems; a Treasury advisory cited in Computer Fraud & Security warned that facilitating payments may risk violating OFAC regulations.
3. Call whoever responds to incidents for you: your IT provider, your insurer's helpline, or a specialist incident response firm. If you have none, say so in your report to the authorities.
4. Report it. In the US, use ic3.gov, tips.fbi.gov or CISA's ransomware reporting page (cisa.gov/stopransomware). In the UK, report to Action Fraud (actionfraud.police.uk) and consider the NCSC. A business that has lost personal data also has a duty to inform the regulator, such as the ICO in the UK, as The Record noted.
5. Check your backups before assuming you have lost everything. CISA notes that many ransomware variants try to find and encrypt or delete backups that are reachable from the network, which is why offline copies matter.
6. Look after the people. Rotate who is on the response, make sure people eat and sleep, and say plainly that nobody is going to be blamed on day one. RUSI found that this kind of strain is overlooked even in large organisations.

How to reduce the chance, and the harm if it happens

None of this is a guarantee, and no vendor can offer one. A CISA official, Gabriel Davis, told Voice of America that not everything can be prevented, and that the aim is to limit the damage when things do happen. Its guidance and the cases above point to a short list:

• Keep offline, encrypted backups and test that you can restore from them. CISA says backups must be offline because many ransomware variants hunt for reachable ones.
• Turn on multifactor authentication for email, remote access and administrator accounts. NPR reported that the Change Healthcare attack involved a portal without it.
• Patch internet-facing systems, especially VPNs. Germany's cyber authority said the Düsseldorf flaw had been publicly warned about months earlier.
• Write a downtime plan that assumes days or weeks, not hours. A University of Michigan pharmacy officer told NPR that most emergency plans he has seen cover only one to three days.

If you need to talk to someone now

If you are in crisis or thinking about harming yourself, you do not have to deal with that alone, and you do not need to wait until the incident is resolved. Support exists, and feelings that seem permanent in the middle of an attack often ease with time and help.

• United States: call or text 988, the 988 Suicide & Crisis Lifeline, at any hour.
• United Kingdom and Ireland: call Samaritans free on 116 123, at any hour.
• Elsewhere, or if someone is in immediate danger: call your local emergency number.

If you are supporting a colleague or an employee who is not coping after an attack, stay with them, listen without trying to fix the technical problem, and help them reach one of these services or a doctor.

Frequently asked questions

What is ransomware?

CISA describes ransomware as malware that encrypts files on a device so that they and the systems that depend on them cannot be used. Criminals then demand payment to unlock them, and often also threaten to publish copied data, which CISA calls double extortion.

What happens in a ransomware attack on a hospital?

Electronic records, test ordering, scanners that check medicines and phone systems can go offline. Staff fall back on paper, faxes and workarounds. In the 2024 Ascension attack, clinicians told NPR about delayed lab results, medication errors and missing safety checks.

Has anyone died because of a ransomware attack?

Some deaths have been linked to attacks, with differing levels of proof. King's College Hospital confirmed that a long wait for a blood test result after the 2024 Synnovis attack was one contributing factor in a patient's death. A German negligent homicide investigation followed a 2020 case, and a lawsuit over a 2019 Alabama case is an allegation that the hospital denies. Reuters noted that direct causation can be difficult to establish.

Does ransomware affect the mental health of victims?

Research suggests it can. A RUSI study based on 42 interviews recorded shame, self-blame, sleep loss, burnout and, in a rare case, a victim brought close to suicide. Most reactions ease with time and support, and help is available.

Should you pay the ransom?

Law enforcement agencies encourage victims not to pay, arguing that payments fuel organised crime, the BBC reported. In the US, facilitating payments can also raise sanctions questions. Report the incident, call your incident response contacts and make the decision with professional advice.

What should a small business do first after a ransomware attack?

Isolate the affected devices from the network, as CISA advises, contact your IT provider or insurer, check your offline backups, and report the incident to the authorities, for example ic3.gov in the US or actionfraud.police.uk in the UK.

How can you prevent a ransomware attack?

No method is a guarantee. CISA recommends offline encrypted backups that you test, multifactor authentication, prompt patching of internet-facing systems, long unique passwords and a written response plan.