Ransomware attacks on ERT, IQVIA, and others involved in hundreds of clinical trials and work on a COVID-19 vaccine, has slowed some trials according to clients
Nicole Perlroth / New York Times :
Context & Ripple Effects
This attack moves ransomware upstream from individual hospitals to the vendor layer that clinical research depends on: ERT and IQVIA run trial data and endpoints for hundreds of sponsors simultaneously, so one compromise touches more studies than a hospital hit ever could. It lands weeks after criminals extracted a $1.14M bitcoin payment from UCSF while the university was racing on COVID-19 vaccine research — proof that research operations pay.
The pattern was already visible on the provider side, where a TrickBot attack at the University of Vermont Medical Center delayed treatment and tests for weeks. Hitting shared service providers like ERT, IQVIA, or workforce-software firm Kronos — whose attack disrupted payroll for millions of US workers — scales the same playbook across every client at once.
First-order effects
- Sponsors running trials through ERT and IQVIA face direct delays — clients confirm some studies have slowed, including COVID-19 vaccine work, right as pandemic timelines carry political and commercial weight.
Second-order effects
- Pharma sponsors and CROs must now price vendor cybersecurity into trial outsourcing decisions, favoring vendors who can demonstrate resilience; the demonstrated willingness to pay, set by cases like UCSF, makes research-linked vendors a higher-value target class.
Third-order effects
- If attackers keep pivoting from single hospitals to multi-client service firms, clinical trial infrastructure gets treated as critical infrastructure — forcing regulatory hardening and security requirements flowing down from sponsors to their entire vendor stack.
The trend: Ransomware is climbing the health-research stack from individual hospitals to shared clinical-trial vendors, where each attack disrupts hundreds of dependent organizations at once.