Hackers Use Ransomware to Attack Hospital Systems During COVID-19 Pandemic

Of all the incidents I’ve studied in cyber security, the wave of ransomware attacks against hospitals during the COVID-19 pandemic remains one of the most disturbing to me. These weren’t attacks on abstract data or corporate profit margins — they were attacks that directly threatened patient care while hospitals were already stretched to their absolute limit. In this article, I want to walk through how these attacks happened, why healthcare became such an attractive target during the pandemic, and what the industry has done in response.

Why Hospitals Became a Prime Target During COVID-19

Ransomware groups have historically avoided some targets out of self-imposed “rules” to avoid excessive law enforcement attention, but the pandemic period saw many of these informal boundaries collapse. Several factors converged to make hospitals unusually attractive targets during 2020-2021:

• Operational pressure meant hospitals were more likely to pay quickly rather than endure prolonged downtime during a public health emergency
• Rapid, often rushed IT changes — telehealth systems, remote work infrastructure, and new COVID-related data systems were deployed faster than security review processes could typically accommodate
• Overwhelmed IT and security staff, many of whom were also dealing with capacity planning for surging patient loads
• High-value, highly sensitive data (patient records, research data, vaccine trial information) made hospitals and research institutions valuable targets for both financial extortion and, in some cases, espionage

How Ransomware Works: A Technical Primer

Ransomware is malicious software that encrypts a victim’s files, rendering them inaccessible, and then demands payment (typically in cryptocurrency) in exchange for a decryption key. Modern ransomware groups also commonly exfiltrate data before encryption — a tactic called “double extortion” — threatening to publish sensitive data even if the victim can restore from backups without paying.

flowchart TD
    A[Initial Access:<br/>phishing/RDP/vulnerability] --> B[Establish foothold<br/>+ disable security tools]
    B --> C[Lateral movement across network]
    C --> D[Identify and exfiltrate<br/>sensitive data]
    D --> E[Deploy encryption payload<br/>across systems]
    E --> F[Ransom note demands payment<br/>+ threatens data leak]

Timeline of Notable Incidents

Anatomy of a Hospital Ransomware Attack

Most of these incidents followed a broadly similar pattern to ransomware attacks in other sectors, but with dramatically higher real-world stakes given the life-safety implications of hospital IT downtime:

1. Initial access — often through phishing emails targeting overwhelmed staff, or exploitation of internet-facing VPN/RDP services that had been rapidly deployed to support remote and telehealth work
2. Reconnaissance and lateral movement — attackers map the network, often taking days to weeks to identify high-value systems (patient records, imaging systems, medical device networks) before triggering encryption
3. Data exfiltration — sensitive patient data copied out before encryption, enabling double-extortion threats
4. Encryption deployment — often timed for weekends or overnight hours when IT staffing is thinnest, maximizing disruption before detection
5. Ransom demand — often accompanied by a countdown timer and threat of data publication to pressure quick payment

Case Study: Universal Health Services (2020)

UHS, one of the largest healthcare providers in the United States operating over 400 facilities, was hit by the Ryuk ransomware variant in September 2020. The attack forced hospitals to revert to pen-and-paper record-keeping, delayed lab results, and in some reported cases required ambulance diversions to other facilities. The company later disclosed the incident cost approximately $67 million in remediation, lost revenue, and related expenses — illustrating that the cost of ransomware extends far beyond any ransom payment itself, whether or not one is made.

Case Study: Düsseldorf University Hospital (2020)

This incident is frequently cited because it may represent the first ransomware attack directly linked to a patient death. The hospital’s systems were compromised (reportedly through a vulnerability in a widely used VPN appliance), forcing emergency department closures. A patient requiring urgent treatment had to be redirected to a hospital roughly 20 miles away, and died following the resulting delay. German prosecutors reportedly investigated the case as potential negligent homicide, though attribution of the death directly to the attack remained a matter of ongoing investigation and debate.

Case Study: Ireland’s HSE Attack (2021)

The Conti ransomware group struck Ireland’s Health Service Executive in May 2021, encrypting systems nationwide and forcing widespread cancellation of outpatient appointments, radiology services, and access to electronic patient records across the country. Unusually, the attackers provided a free decryption key after Ireland’s government publicly refused to pay the ransom, though the HSE still faced a recovery process that reportedly took months and cost tens of millions of euros. A subsequent independent review commissioned by the HSE found significant gaps in cybersecurity governance and investment predating the attack.

Why Healthcare Is Uniquely Vulnerable

Defensive Strategies for Healthcare Organizations

• Network segmentation between clinical/medical device networks and general administrative IT systems, so a compromise in one doesn’t automatically cascade into the other
• Prioritized patching for internet-facing systems (VPN appliances, remote access tools), which have repeatedly served as initial access points in major healthcare breaches
• Immutable, tested, offline backups specifically for critical patient care systems, following the 3-2-1 backup principle
• MFA enforced on all remote access and administrative accounts
• Incident response plans that explicitly account for continuity of patient care, not just IT recovery, aligned with guidance like NIST SP 800-66 (HIPAA Security Rule implementation guidance)
• Regular tabletop exercises simulating ransomware scenarios specifically for clinical environments

Comparing Ransomware Families Active During This Period

Regulatory and Industry Response

The wave of healthcare ransomware attacks during the pandemic accelerated several policy responses. In the US, the Department of Health and Human Services increased guidance and enforcement focus on HIPAA Security Rule compliance, particularly around risk analysis requirements. CISA and the FBI issued joint advisories specifically warning healthcare organizations about targeted ransomware campaigns during this period. Internationally, incidents like the HSE attack prompted formal government reviews and increased cybersecurity funding commitments for public healthcare systems. The healthcare sector has also seen growing adoption of information sharing through Health-ISAC (Health Information Sharing and Analysis Center) to accelerate threat intelligence distribution across otherwise competing institutions.

The Broader Pattern: Ransomware Targeting Critical Infrastructure

The healthcare-focused attacks during COVID-19 weren’t an isolated phenomenon — they fit into a broader pattern of ransomware groups increasingly targeting critical infrastructure sectors more generally throughout this period, from the Colonial Pipeline attack (2021, affecting fuel distribution across the US East Coast) to attacks on water treatment facilities and emergency services dispatch systems. What ties these together is a shift in ransomware group targeting logic: sectors where downtime is catastrophic and immediate (rather than merely costly over time) create maximum pressure to pay quickly, which from a purely criminal-economic perspective makes them rational, if morally reprehensible, targets. Healthcare during a pandemic represented perhaps the most extreme version of this dynamic, since the underlying operational pressure (a public health emergency) was itself the reason the sector was already stretched thin before any attack occurred.

Attribution and Law Enforcement Response

Attribution in ransomware cases is notoriously difficult, since groups frequently rebrand, share tooling, and operate across jurisdictions with limited cooperation with Western law enforcement. That said, several notable law enforcement actions followed this wave of healthcare-targeted attacks. In 2022, the US Department of Justice, in coordination with international partners, disrupted infrastructure associated with the Conti ransomware group following extensive investigation, though the group’s members and affiliated tooling reportedly splintered into several successor operations rather than disappearing entirely — a common pattern in ransomware group takedowns, sometimes described as a “hydra effect” where disrupting one operation leads to several smaller successors rather than a clean resolution.

Lessons for Healthcare IT Leadership

Reflecting on this period, several lessons stand out for healthcare IT and security leadership specifically:

• Rushed digital transformation needs a fast-follow security review. The pandemic forced legitimate, necessary rapid deployment of telehealth and remote work infrastructure, but security review processes need a compressed, expedited track for genuine emergencies rather than being skipped entirely.
• Downtime procedures matter as much as prevention. Hospitals that had well-rehearsed manual/paper-based fallback procedures for clinical operations fared better operationally during system outages than those relying entirely on digital systems with no tested fallback.
• Board-level visibility changes outcomes. Organizations where cybersecurity risk was a standing board-level agenda item, backed by real budget authority, generally responded and recovered faster than those where security was treated as a purely IT-department concern.
• Sector-wide information sharing has real value. Health-ISAC membership and participation in threat intelligence sharing consistently correlated with faster detection and response in post-incident reviews across the sector.

FAQs

Did hospitals typically pay the ransom during these attacks? It varied by incident. Some organizations, like Ireland’s HSE, publicly refused to pay and instead relied on backups and, in that specific case, an unusual free decryption key provided by the attackers. Others faced greater pressure to pay given the immediate patient safety stakes involved.

Were these attacks specifically designed to target hospitals during COVID-19? Evidence suggests a mix: some attacks were opportunistic against already-vulnerable systems, while threat intelligence reports (including joint CISA/FBI/HHS advisories) documented specific campaigns deliberately targeting healthcare during this period, exploiting the sector’s heightened operational pressure.

Can ransomware directly cause patient deaths? The Düsseldorf case is the most cited example where a patient death followed a ransomware-forced facility diversion, though definitive causal attribution in such cases can be legally and medically complex. Regardless of direct causation debates, the disruption to critical care systems during these attacks represents a serious patient safety risk.

What’s the single most important defense for a hospital against ransomware? Network segmentation combined with tested, offline backups consistently proves most effective, since it limits how far an initial compromise can spread and ensures recovery doesn’t depend on paying attackers.

Summary and Recommendations

The ransomware attacks against hospitals during the COVID-19 pandemic represent one of the starkest examples of cybercrime’s real-world consequences, moving far beyond financial loss into direct threats to patient safety. Chronic underinvestment in healthcare IT security, combined with rushed pandemic-era system changes and legacy medical device infrastructure, created ideal conditions for attackers exploiting an already-overwhelmed sector. The response since has included stronger regulatory guidance, increased information sharing, and growing investment in segmentation and backup resilience — but the sector’s structural vulnerabilities mean healthcare will likely remain a high-value target for ransomware groups going forward.

Further reading:

• CISA/FBI/HHS Joint Ransomware Advisory for Healthcare: https://www.cisa.gov/news-events/cybersecurity-advisories
• HHS HIPAA Security Rule Guidance: https://www.hhs.gov/hipaa/for-professionals/security/index.html
• Health-ISAC: https://health-isac.org/
• NIST SP 800-66 (HIPAA Security Rule Implementation Guide): https://csrc.nist.gov/pubs/sp/800/66/r2/final