Scourge · September 10 2020

In Memoriam: the Attack on Düsseldorf University Hospital

Chronicle

On 10 September 2020 ransomware that got in through a Citrix vulnerability disclosed months earlier disabled about 30 servers at University Hospital Düsseldorf, which had to stop accepting emergency admissions. A critically ill patient was sent to a hospital in Wuppertal, about thirty kilometres away, and died. Prosecutors opened a negligent-homicide investigation against persons unknown, later dropped: investigators concluded that the delay had not been decisive for her death, so a causal link to the attack was not proven. It was never publicly established whether the attackers got in before the fix was applied. The ransom note was addressed to the university; when police told the attackers they had hit a hospital, they handed over the decryption key.

Lesson learned

The case is remembered as the first in which a person's death was linked, at least as an investigative hypothesis, to a cyberattack. It reminded everyone that hospitals are critical infrastructure and that remote-access systems must be patched without delay.

How it is remembered

Remembered by patching remote-access systems at once, preparing continuity plans for emergency care and remembering that behind every health system there are people.