Report: 22% of health care providers saw an increase in patient mortality following a cyberattack, driven by COVID-19 and third-party vendor security gaps
A new report from the Ponemon Institute reinforces the patient safety risks posed by ransomware attacks: 22% of surveyed providers saw … Source: Censinet .
Context & Ripple Effects
The $6B annual cost that cyberattacks were already imposing on the US healthcare system in 2015 was framed as a financial problem; the Ponemon Institute's new finding recasts it as a clinical one — 22% of surveyed providers saw patient mortality rise after an attack, with COVID-19 strain and third-party vendor security gaps named as the drivers.
That lands amid a documented escalation: the EU counted a 47% rise in attacks on hospitals across its critical sectors in 2020 (304 malicious attacks overall, more than double 2019's total), while ransomware dominated cyber insurance claims earlier that year.
First-order effects
- Health care providers running COVID-era capacity now have survey evidence tying attack recovery time directly to patient outcomes, shifting ransomware from an IT budget line to a clinical risk their boards must own.
Second-order effects
- Third-party vendor security gaps are cited as a driver, so hospitals will push contractual security requirements down to suppliers, and insurers pricing off ransomware's claim share will re-examine coverage for provider clients.
Third-order effects
- If payment does not end the exposure — one study found 80% of ransom payers were hit again — the sector drifts toward regulation-driven resilience standards for hospitals and their vendor chains, treating care disruption as a systemic safety issue rather than a private loss.
The trend: Healthcare is becoming the most-targeted sector for cyberattacks — later confirmed by Omdia's count of 241 disclosed attacks in nine months of 2023 — forcing patient safety and vendor security into the same governance conversation.