Researchers: at least 750 US hospitals faced disruptions on the day of last year's big CrowdStrike outage, and 200+ had outages related to patient care services
When, one year ago today … Jeff Tully : New research from the UC San Diego Center for Healthcare Cybersecurity: in a paper published in JAMA Network Open, we describe disruptions … Forums: Msmash / Slashdot : At Least 750 US Hospitals Faced Disruptions During Last Year's CrowdStrike Outage, Study Finds
Context & Ripple Effects
The hospital findings put a health-care-specific scale on an outage already understood as a consequence of the privileged access endpoint tools need: security software’s access to core operating systems can turn a faulty update into an operational failure.
They also extend the outage’s economic aftermath. Earlier coverage found that much of the damage was likely uninsured, while an estimate put Fortune 500 losses from the incident at $5.4B excluding Microsoft. The new research shows that critical-care delivery was part of that exposure, not merely back-office IT.
First-order effects
- The study gives hospitals, health-system boards, and CrowdStrike a documented measure of how broadly the incident disrupted hospital operations: at least 750 hospitals were affected, with more than 200 reporting patient-care-service outages.
- For affected providers, the evidence sharpens the case for reviewing endpoint-update controls and clinical-service continuity procedures, because the disruption reached patient-facing systems.
Second-order effects
- Health-care customers will have greater reason to demand staged deployment, rollback capability, and clearer outage-response commitments from endpoint-security vendors whose products run with deep system access.
- The findings strengthen the case for treating vendor-caused software outages alongside cyber incidents in hospital resilience planning, especially given prior clinical-operations disruption at Ascension after a suspected cyberattack.
Third-order effects
- If hospitals and regulators apply the lesson broadly, critical-infrastructure buyers may shift procurement toward demonstrable operational resilience—not just threat-detection performance—for security tooling.
- The episode points to a harder-to-insure concentration risk: a single widely deployed software supplier can create correlated interruptions across many institutions, potentially pushing more risk management into technical controls and contractual terms.
The trend: Critical infrastructure is increasingly treating deeply integrated security software as both a defense layer and a potential source of systemic operational risk.