Ransomware attacks on hospitals
An attack that encrypts the systems of a hospital, laboratory or healthcare vendor and threatens to publish patient data, using the disruption of care as leverage to extract a ransom.
Ransomware against a healthcare facility encrypts a hospital's or laboratory's systems and threatens to publish patient data, using the disruption of care as leverage. The sector is a prime target because a hospital cannot wait. France's ANSSI counted 30 healthcare facilities encrypted in 2022 and 2023, about 10% of the ransomware cases reported to it. IBM's 2024 report put the average cost of a healthcare data breach at 9.77 million dollars, the highest of any sector for the fourteenth year running. Each case taught the market something. WannaCry (May 2017) shut down services across England's National Health Service through unpatched machines, with no ransom aimed at them. Ireland's HSE (May 2021) showed that an entire national network could go down at once. Change Healthcare (February 2024) moved the loss onto the billing vendor, with losses at thousands of providers. Synnovis (June 2024) did the same with London's blood testing. A hospital's cyber policy looks little like a small business's. Business interruption is measured on canceled procedures, and extra expense includes patient transfers. Liability drifts toward bodily injury, which many cyber policies exclude and which hospital liability cover has not always priced. The line in French public hospitals is not to pay, and CHSF held it in 2022.
Textbook case: a 1,500-bed teaching hospital is encrypted on a Saturday night. The emergency department runs on diversion for three weeks and 40% of scheduled procedures are postponed. Lost revenue reaches 9 million euros, with 4 million more for vendors and restoration. The cyber policy, capped at 10 million with a 500,000-euro retention, leaves the hospital with 3 million euros, before any claims from patients whose care was delayed.
hospital ransomware, healthcare ransomware, ransomware against hospitals, health system ransomware
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.