When Ransomware Kills: Healthcare’s Patient Safety Crisis

The Line Has Been Crossed

For years, the cybersecurity community debated whether ransomware could directly cause patient deaths. That debate is over. A growing body of evidence — clinical data, incident investigations, and academic research — now demonstrates a causal link between healthcare ransomware attacks and patient mortality. The question is no longer whether ransomware kills, but how many deaths can be attributed to it and what the healthcare sector is willing to do about it.

The most striking clinical evidence comes from a peer-reviewed study published in the Journal of the American College of Emergency Physicians in 2024, conducted by researchers at the University of California San Diego’s Center for Healthcare Cybersecurity. The study examined cardiac arrest outcomes at untargeted hospitals adjacent to a ransomware-attacked healthcare delivery organization during a May 2021 incident. During the attack period, out-of-hospital cardiac arrest (OHCA) survival with favorable neurologic outcome collapsed from 40.0% to just 4.5% at the nearby hospitals receiving diverted patients. The mechanism was straightforward: when ambulances are diverted from attacked hospitals, transport times to alternative facilities increase, delaying advanced resuscitation and post-arrest care — producing measurably worse outcomes.

And in February 2026, the University of Mississippi Medical Center (UMMC) — one of the largest health systems in the state, with seven hospitals, 35 clinics, and more than 10,000 employees — was struck by a ransomware attack that forced the simultaneous closure of all 35 clinic locations statewide, cancellation of chemotherapy sessions and elective surgeries, and degradation of its EPIC electronic medical record system. The clinics remained closed for approximately 11 days. The UMMC attack brought the healthcare ransomware crisis into sharp public focus.

These are not isolated cases. According to BlackFog’s 2025 State of Ransomware Report, disclosed ransomware attacks increased 49% year-over-year to a record 1,174 attacks in 2025. Healthcare retained its position as the single most targeted sector, accounting for 22% of all disclosed attacks — more than double the rate of the next most affected sectors. In 2025, 96% of all ransomware attacks involved data exfiltration prior to encryption, and the average cost of a healthcare data breach reached $7.42 million.

The UMMC Case: A February 2026 Healthcare Catastrophe

The ransomware attack on the University of Mississippi Medical Center in February 2026 illustrates the devastating real-world impact of healthcare cyberattacks.

The Attack

The attack was detected in the early hours of Thursday, February 19, 2026, impacting UMMC’s network and many of its IT systems, including its EPIC electronic medical record system. UMMC officials confirmed that a ransomware attack was responsible for knocking the computer network offline. Law enforcement was alerted, and UMMC coordinated with the Department of Homeland Security and the FBI.

Clinical Impact

The immediate clinical impact was severe. Hospital officials halted care at all 35 of UMMC’s clinics statewide. Appointments, chemotherapy sessions, and elective procedures were canceled. The electronic health record system became unavailable, forcing clinicians to rely on paper-based downtime protocols — a workflow that most current-generation physicians and nurses have limited experience with. Medication administration systems went offline, creating risks of dosing errors, drug interactions, and missed medications. Diagnostic imaging systems were disrupted, delaying or preventing CT scans, MRIs, and X-rays. Laboratory information systems were degraded, delaying test results that inform critical treatment decisions.

Emergency services remained available at UMMC with downtime protocols in effect, but the outpatient clinic closures forced the diversion of patients — including children with complex medical conditions — to already-strained regional facilities, delaying care and creating bottlenecks across the Mississippi healthcare system. The clinics did not reopen until approximately March 2, 2026, more than 11 days after the initial attack.

The Broader Clinical Evidence

The UCSD study on the 2021 incident provides the most rigorous clinical quantification of ransomware’s impact on patient outcomes. Researchers evaluated 78 total cardiac arrests at two untargeted academic hospitals adjacent to the ransomware-infected facility, comparing pre-attack, attack, and post-attack periods. The number of total cardiac arrests increased significantly during the attack phase (38 observed vs. 21 pre-attack), exceeding forecasted levels. The collapse of OHCA survival from 40.0% to 4.5% during the attack period — followed by recovery to 41.2% after the attack — demonstrates a clear temporal association between the cyberattack and worsened clinical outcomes. EMS diversions appear to have prolonged transport times to advanced care, consistent with prior research linking longer ambulance transport times to higher 30-day mortality.

The Upstream Attack Strategy

Healthcare organizations increasingly face threats not just from direct attacks on their own systems but from attacks on their vendors, suppliers, and service providers — a strategy that security researchers call “upstream targeting.”

The Change Healthcare attack of February 2024 demonstrated the devastating potential of this approach. Change Healthcare, a subsidiary of UnitedHealth Group, processes approximately 15 billion healthcare transactions annually — serving as a critical intermediary between healthcare providers, insurers, and pharmacies. When the BlackCat/ALPHV ransomware group exploited a vulnerable Citrix remote access service lacking multi-factor authentication, they gained access to Change Healthcare’s systems and deployed ransomware that knocked the platform offline for approximately two months. The cascading effects disrupted claims processing, prescription fulfillment, and revenue cycles at hospitals and clinics across the United States.

The breach affected approximately 190 million Americans — more than half the U.S. population — making it the largest healthcare data breach ever reported. UnitedHealth Group paid a $22 million ransom, but the total cost of the incident reached approximately $3.1 billion by the end of 2024, according to the company’s financial filings.

The upstream targeting strategy is strategic, not opportunistic. By compromising a vendor that serves thousands of healthcare organizations, attackers achieve a multiplicative impact — one successful breach can disrupt care delivery across an entire region or specialty. Managed service providers (MSPs) that handle IT operations for smaller healthcare facilities are particularly attractive targets, as they provide a single point of access to dozens or hundreds of healthcare environments.

The trend toward healthcare IT consolidation has amplified this risk. As hospitals adopt cloud-based EHR systems, laboratory information services, and telehealth platforms, they create dependencies on a smaller number of critical vendors. The concentration of healthcare data and operations in a handful of platforms creates systemic risk — a single vendor compromise can cascade across the entire healthcare system.

Double Extortion and Patient Data

The near-universal adoption of double extortion tactics by ransomware operators has added a dimension of harm that extends beyond operational disruption. In double extortion, attackers both encrypt systems and exfiltrate sensitive data, threatening to publish the data if the ransom is not paid. BlackFog’s 2025 data shows that 96% of all ransomware attacks involved data exfiltration prior to file encryption. For healthcare organizations, this means protected health information (PHI) — medical records, diagnoses, treatment histories, mental health records, substance abuse treatment records, and HIV status.

The sensitivity of health data makes double extortion particularly coercive for healthcare organizations. While a financial services company might absorb the reputational impact of a data leak, the publication of patient medical records causes direct, personal harm to individuals. Patients whose mental health records, substance abuse histories, or HIV status are published face discrimination, social stigma, and personal distress that no remediation program can address.

Sophos’s 2025 State of Ransomware in Healthcare report found that the proportion of healthcare providers experiencing extortion-only attacks — where data was stolen but not encrypted — tripled to 12% in 2025 from 4% in 2022/2023, the highest rate across all sectors. This underscores the particular leverage that stolen healthcare data provides to attackers. The most prolific ransomware group of 2025 — Qilin — claimed over 1,100 disclosed and undisclosed attacks and was behind two of the most impactful healthcare incidents of the year.

Recovery Timelines: The Extended Disruption

Healthcare ransomware recovery timelines are consistently longer and more complex than in other sectors, reflecting the critical nature of clinical systems and the regulatory requirements that govern their restoration.

Industry data from 2025 shows that ransomware attacks led to an average of nearly 19 days of downtime for U.S. healthcare organizations. But this figure understates the full recovery challenge — total recovery to full operational capacity averages 279 days, with only 58% of organizations achieving complete operational restoration, according to healthcare cybersecurity statistics compiled in 2025. Full recovery includes not just system restoration but data integrity verification (ensuring that patient records have not been altered), regulatory compliance (confirming that the restored environment meets HIPAA and other requirements), and clinical validation (testing that medical devices and clinical decision support systems function correctly post-restoration).

There are some encouraging signs: Sophos found that nearly 60% of healthcare providers recovered within one week in 2025, up from just 21% the previous year. But this initial recovery often represents only partial restoration — enough to resume basic operations but far from full capacity.

During the recovery period, healthcare organizations operate in degraded mode — a combination of manual processes, temporary systems, and workarounds that reduce both the volume and quality of care they can deliver. Patients are diverted to other facilities, procedures are postponed, and the clinical staff is burdened with manual workflows that increase workload and error rates.

The economic cost is substantial. UnitedHealth Group reported that the Change Healthcare incident ultimately cost the company approximately $3.1 billion — a figure that does not include the costs borne by the thousands of downstream healthcare providers whose operations were disrupted. Globally, the average cost of a healthcare data breach reached $7.42 million in 2025.

What the Sector Must Change

The healthcare ransomware crisis is not primarily a technology problem — it is a governance, investment, and architecture problem. The sector’s vulnerabilities reflect decades of underinvestment in cybersecurity, architectural decisions that prioritized convenience over resilience, and a regulatory environment that has not kept pace with the threat landscape.

Segmentation and Architecture

Healthcare networks are notoriously flat — a characteristic that allows ransomware to spread rapidly from an initial foothold to clinical systems. Network segmentation that isolates clinical systems, medical devices, administrative systems, and guest networks into separate security zones would significantly limit the blast radius of a ransomware event. The investment is substantial but the cost of not segmenting is demonstrably higher.

Immutable Backups and Rapid Recovery

The ability to restore clinical systems rapidly from clean backups is the single most effective mitigation for ransomware. Backups must be immutable (protected from encryption or deletion by the attacker), regularly tested, and integrated into recovery procedures that can bring critical clinical systems online within hours — not days or weeks.

Medical Device Security

Connected medical devices — infusion pumps, patient monitors, imaging systems — often run outdated operating systems, cannot be easily patched, and are connected to the same networks as administrative systems. A dedicated medical device security program that inventories all connected devices, segments them from the broader network, and monitors them for anomalous behavior is essential.

Vendor Risk Management

The upstream attack strategy demands that healthcare organizations rigorously assess and monitor the cybersecurity posture of their critical vendors. This includes contractual security requirements, regular vendor security assessments, incident notification requirements, and contingency plans for vendor unavailability.

Workforce Training and Resilience

Clinical staff need regular training on both cyber hygiene (to prevent initial compromise) and manual downtime procedures (to maintain care quality when systems are unavailable). Downtime drills — periodic exercises where clinical operations continue without electronic systems — build the muscle memory that is critical during an actual incident.

Regulatory Evolution

Regulators are moving from voluntary guidelines to enforceable mandates. The U.S. Department of Health and Human Services published voluntary Healthcare and Public Health Cybersecurity Performance Goals (CPGs) in January 2024, dividing them into “essential” baseline standards and “enhanced” goals for more sophisticated practices. In January 2025, HHS published a proposed rule to strengthen the HIPAA Security Rule for electronic protected health information (ePHI), with finalization expected by mid-2026. Once finalized, the rule would include a six-month compliance grace period. These are steps in the right direction, but the gap between voluntary guidance and mandatory, enforceable standards remains a critical vulnerability.

The Moral Imperative

The evidence that ransomware harms patients — and the growing data linking it to mortality — creates a moral imperative that transcends business-case calculations. When cardiac arrest survival drops from 40% to 4.5% at hospitals receiving diverted patients during a cyberattack, cybersecurity is not an IT issue — it is a patient safety issue of the highest order.

Healthcare executives who have not prioritized cybersecurity investment can no longer claim ignorance of the consequences. Board members who have not demanded security briefings with the same rigor they demand financial reports are failing their fiduciary duty. And regulators who have not established enforceable minimum security standards are complicit in an avoidable crisis.

The healthcare ransomware crisis will not resolve itself. It requires deliberate, sustained investment and a fundamental shift in how the sector thinks about cybersecurity — not as a cost center, but as a core component of patient safety. The data is clear. The evidence is documented. The only remaining question is whether the healthcare sector will act before the next attack produces the next tragedy.

Sources & Further Reading

• Ransomware Cyberattack Associated With Cardiac Arrest Incidence and Outcomes at Untargeted, Adjacent Hospitals — UCSD/PMC (2024)
• UMMC Shuts Clinics While It Grapples with Ransomware Attack — HIPAA Journal (2026)
• Healthcare Remains the Sector Most Targeted by Ransomware Groups as Attacks Increase 49% YOY — HIPAA Journal / BlackFog (2025)
• The State of Ransomware in Healthcare 2025 — Sophos
• Change Healthcare Attack Cost Estimate Reaches Nearly $2.9B — BankInfoSecurity
• HPH Cybersecurity Performance Goals — HHS Cyber Gateway