Staff and patients at the University of Vermont Medical Center describe devastating effects of treatment and test delays after a TrickBot ransomware attack
A wave of damaging attacks on hospitals upended the lives of patients with cancer and other ailments. “I have no idea what to do,” one said.
New York Times
Context & Ripple Effects
This is the moment hospital ransomware stopped being an IT story and became a patient-safety story. The template was set in May 2017, when the WannaCry outbreak locked staff out of computers across UK hospitals and forced emergency diversions — disruption, but no documented body count. Through 2020 the stakes climbed: in September, [[a:958029|German media reported a patient died after a ransomware attack forced a hospital to send them elsewhere]], and weeks later attacks on ERT and IQVIA were slowing hundreds of clinical trials, including COVID-19 vaccine work.
First-order effects
Patients at the University of Vermont Medical Center — including people with cancer — are living with delayed treatments and tests while staff work around locked systems, converting an attack on servers into missed care windows that cannot be recovered later.
The medical center must choose between diverting cases to other facilities, as UK hospitals did in 2017, or running degraded manual operations, both of which extend the harm beyond its own walls.
Second-order effects
Every peer hospital watching this coverage now faces a sharper calculus over ransom payment and network segmentation, because the German death and UVM's patient accounts show downtime is measured in clinical outcomes, not just revenue days.
Attackers learn that hospitals' tolerance for downtime is uniquely low, making healthcare targets more likely to pay quickly — a dynamic the FBI was still investigating a year later in the Prospect Medical Holdings attack across 16 hospitals.
Third-order effects
If the pattern holds — WannaCry's lockouts, a death in Germany, slowed trials, and now documented treatment delays — hospital ransomware stops being treated as a cybercrime cost center and gets handled as a public-health risk, pulling in regulators and law enforcement rather than leaving response to individual CIOs.
Hospitals will be pushed toward segmenting clinical systems from business networks and pre-arranged mutual-aid diversion agreements, restructuring how care continuity is planned around the assumption that core IT can vanish overnight.
The trend: Ransomware is escalating from locking hospital computers to directly endangering patients, moving healthcare cyberattacks from an IT expense toward a regulated patient-safety issue.
Powerful Russian cybercriminals are disabling US hospitals, & the motive may not be profit. My report w @nicoleperlroth. “It's like asking what's the point of putting a bomb in an elementary school,” said a nurse. “There is a lot of evil in the world.” https://www.nytimes.com/...
How can this be allowed to happen, I wonder as I read this? Patients of a Vermont Hospital Are Left ‘in the Dark’ After a Cyberattack @EllenBarryNYT @nicoleperlroth https://www.nytimes.com/...
Great writeup of the human cost and real victims of the cynical, growing number of cyberattacks on hospitals. At @CyberpeaceInst we started #cyber4healthcare to help prevent, understand and defend ↘️ https://www.nytimes.com/...
Beyond despicable. A wave of damaging #ransomware cyberattacks on hospitals has upended the lives of patients with cancer and other ailments https://www.nytimes.com/... #cybersecurity
Great story by @nicoleperlroth and @EllenBarryNYT about the toll ransomware is taking on hospitals and their patients. Time for the gloves to come off and unleash @US_CYBERCOM @FBI and other USG capabilities against these criminal actors? @riskybusiness https://www.nytimes.com/..…
The attacks have largely unfolded in private, as hospitals scramble to restore their systems — or to quietly pay the ransom — without releasing information that could compromise an F.B.I. investigation. https://www.nytimes.com/...
Fascinating account of the horrifying effects of the Vermont hospital ransomware attack, brilliantly told by @EllenBarryNYT and @nicoleperlroth https://www.nytimes.com/...
When Donald J. Trump fired his cybersecurity chief in a fit of pique, he also disrupted efforts to protect US hospitals from Russian ransomware attacks. Gotta ask: what would look different if he was deliberately trying to kill people? https://www.nytimes.com/...
Complicating the response, President Trump last week fired #ChristopherKrebs, director of #CISA, the #cybersecurity agency that defends critical systems v #cyberattacks, after Mr. Krebs disputed Mr. Trump's baseless claims of #voterfraud. https://www.nytimes.com/...