Healthcare · 2020
Ransomware at Düsseldorf University Hospital
A hospital went 13 days without receiving emergencies; a death was investigated without proven causation.
What happened
On September 10, 2020, ransomware encrypted about 30 servers at Düsseldorf University Hospital. The hospital withdrew from emergency care and postponed scheduled procedures. That night, a critically ill patient was sent 30 km to another hospital and later died. Prosecutors investigated whether the delay amounted to negligent homicide, the first inquiry of its kind involving ransomware.
Authorities linked the intrusion to a known flaw in the hospital's Citrix remote-access gateway. The hospital installed Citrix's patch when it was released, but evidence indicated that the attackers had entered earlier and left a backdoor that the patch alone would not remove. After police told the attackers that they had paralyzed a hospital, they withdrew the ransom demand and supplied a decryption key. Prosecutors later closed the inquiry into the patient's death because medical evidence could not establish causation; the ransomware attack itself, the shutdown and the emergency diversion were confirmed.
What would have changed it
A patch may not remove access established earlier. A scoped review can check remote access, investigate persistence, and document what still needs attention.