Multiple hospitals across UK hit by ransomware attack, locking staff out of their computers and forcing hospitals to divert emergency patients
Many hospitals having to divert emergency patients, with doctors reporting messages demanding money … Hospitals across England have been hit …
Context & Ripple Effects
The 2017 attack on hospitals across England is the opening data point in what later coverage shows is a recurring pattern: ransomware groups returning to healthcare again and again. The NHS was hit again in 2023, when an ALPHV-claimed breach put over a million patients' data at risk, and in 2024, when an attack on pathology supplier Synnovis disrupted several London hospitals.
First-order effects
- Hospital staff are locked out of their computers mid-shift, forcing emergency departments to divert ambulances to other hospitals while systems stay encrypted.
- Doctors face ransom demands for restored access, turning clinical operations into direct leverage against the NHS.
Second-order effects
- Attackers learn that hospitals cannot tolerate downtime, making them prime targets — a lesson the 2020 German case made lethal when a diverted patient died after a hospital ransomware attack.
- Third-party suppliers become the soft entry point: the 2024 Synnovis attack showed that compromising one pathology provider can disrupt multiple London hospitals at once.
Third-order effects
- If the pattern holds, healthcare becomes a structurally targeted sector rather than an opportunistic one, pushing the NHS — an employer of 1.7M people caring for 68M residents — toward treating cyber resilience as core clinical infrastructure, not IT overhead.
The trend: Healthcare ransomware has evolved from a disruptive one-off in 2017 into a repeated targeting of hospitals and their suppliers, with patient safety — not just data — as the stake.