Skip to content
←Back to glossaryCyber

Düsseldorf University Hospital ransomware attack (2020)

Ransomware that crippled Düsseldorf University Hospital in September 2020; the death of a patient diverted to another hospital raised in Europe the question of a death caused by a cyberattack.

Definition

The attack on Düsseldorf University Hospital is the September 2020 ransomware case that raised, for the first time in Europe, the question of a death caused by a cyberattack. On September 9 and 10, 2020, the attackers came in through a flaw in widely used Citrix software (CVE-2019-19781), disclosed in December 2019 and patchable since January 2020. About thirty servers were encrypted and the hospital withdrew from emergency care. A critically ill patient who was due to be admitted was diverted to Wuppertal, some thirty kilometers away, and died. The ransom note was addressed to Heinrich Heine University. When police told the attackers, whom the press linked to the DoppelPaymer group, that a hospital was paralyzed, they handed over the decryption key and vanished. Cologne prosecutors opened a negligent homicide investigation. They closed it in November 2020: no causal link between the attack and the death could be established, since the patient's condition made the delay in care non-decisive. For the underwriter, the case settled two ideas. Bodily injury is a plausible cyber scenario, even when it cannot be proven in court. And causation, with its medical expert reports, decides the liability claim. Wording drafters took it as a reason to state whether a cyber policy's bodily injury exclusion also reaches injuries that follow a disruption of care.

Its 7 cross-references, woven across the glossary's 18 categories
Düsseldorf University Hospital ransomware attack (2020): Cyber glossary illustration, AlgoPolis
Example

Textbook case: an encrypted hospital diverts its emergency department, a transferred patient dies, and the family sues the hospital for 400,000 euros. The cyber policy excludes “any bodily injury,” the hospital liability policy excludes “computer events.” Each insurer points to the other. Whether the triggering fact is framed as a care failure or an IT security failure decides which one pays, months before anyone knows whether causation holds.

Read next
CyberRansomware attacks on hospitalsAn attack that encrypts the systems of a hospital, laboratory or healthcare vendor and threatens to publish patient data, using the disruption of care as leverage to extract a ransom.Read the entry →CyberRansomwareMalicious software that encrypts a victim's data or locks its systems in order to extort a ransom, the main driver of cyber losses since 2019.Read the entry →CyberSilent cyber (non-affirmative cyber)Cyber exposure implicitly embedded in a traditional policy that neither explicitly mentions nor excludes cyber.Read the entry →
Put it to work
SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Also known as

Dusseldorf hospital ransomware, Dusseldorf University Hospital attack, UKD ransomware 2020, first ransomware death case

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.