When a hospital diverts, the whole region absorbs the attack

The week

On the night of September 9 to 10, 2020, the computers at University Hospital Düsseldorf, a major university hospital in Germany, began to fail. The cause was ransomware: malicious software that scrambles, or “encrypts,” an organization’s files and systems so they cannot be used, followed by a demand for payment in exchange for the key that unscrambles them.

The hospital reported the incident to the BSI on September 10, as German IT security law required. According to a report by North Rhine-Westphalia’s justice minister, cited by the Associated Press, about 30 servers had been encrypted. The hospital said there were no indications that data had been irretrievably lost, and it began restarting its systems step by step.

A hospital without its computers cannot work normally. It cannot reliably see lab results, order medications electronically or know which beds are free. So University Hospital Düsseldorf did what hospitals are supposed to do when they cannot safely receive emergencies: it withdrew from emergency care while it recovered, telling ambulances to go elsewhere. Planned operations were postponed.

The hospital said the attackers had exploited a weakness in widely used commercial software. Germany’s federal cybersecurity agency, the BSI, issued a warning about the attack and urged organizations to close a known and actively exploited vulnerability in Citrix remote access products. Remote access products are the gateways that let staff and suppliers log in to internal systems from outside the building, and because they face the open internet, a flaw in one is especially dangerous. The intrusion was widely reported to have come through that flaw.

The vulnerability itself was not new. The BSI’s warning, issued on September 17, identified it as CVE-2019-19781, a flaw in Citrix Gateway and Citrix Application Delivery Controller that had been known since December 2019. Citrix had made security updates available in January 2020, and the BSI had warned about the flaw that month. The agency’s point in September was a sharper one. Some systems had been compromised before the updates were installed, and attackers could keep their access to the networks behind them even after the hole was closed. Patching in January did not prove a system was clean.

Then came the part of the story that made headlines around the world. A woman needing urgent care was taken by ambulance to a hospital in Wuppertal, farther away, and died. Prosecutors opened an investigation into whether the attackers could be held responsible for her death.

Wuppertal is about 32 kilometers from Düsseldorf. The Associated Press reported that doctors there could not begin treating her for about an hour, and that prosecutors had opened an investigation against unknown perpetrators on suspicion of negligent manslaughter. The case was widely described as the first death linked to a ransomware attack.

Two further details made the episode stranger. It was widely reported that the ransom note was addressed not to the hospital but to the affiliated Heinrich Heine University. It was also reported that the attackers supplied a decryption key after police told them a hospital had been hit. The criminals may not even have meant to strike a hospital, and they handed over the means to recover once they knew. That was no help to the patients already being driven elsewhere.

The ransom note, left on one server, named no sum, and the hospital said there had been no concrete ransom demand. Düsseldorf police contacted the perpetrators, told them that a hospital rather than a university had been affected and that patients were in danger, and received the key. After that the attackers could no longer be reached. Restoring systems with the key still took time. Each system had to be checked for anything the attackers had left behind, then brought back in a safe order, starting with the infrastructure everything else depends on.

The attack came as hospital ransomware was rising elsewhere. Later that month, Universal Health Services, which operates hundreds of hospitals and behavioral health facilities in the United States and the United Kingdom, was hit by ransomware that disrupted its systems. On October 28, the FBI, the Cybersecurity and Infrastructure Security Agency and HHS issued a joint advisory warning of an increased and imminent ransomware threat to U.S. hospitals and health care providers.

Prosecutors later concluded that the delay was unlikely to have been decisive in the patient’s death. By then the case had already been told, and retold, as a death caused by ransomware. The more durable story is what happened to everyone else when one hospital switched off its emergency department.

The Citrix flaw widely linked to this attack is one part of the Düsseldorf story. The other part is one that boards and regional leaders tend to miss.

Once a hospital loses its core systems and closes its doors to ambulances, the incident stops being one organization’s problem. Patients travel farther. Neighboring emergency departments fill up. The ambulance service runs longer trips with the same fleet. Few regions in 2020 planned for that as a cyber scenario, and fewer still measured what it cost.

How ransomware shuts a hospital down

A modern hospital runs on a handful of large computer systems that most executives never see. The most important is the electronic health record, the digital chart that holds each patient’s history, allergies, medications, test results and doctors’ notes. Around it sit systems for the laboratory, for imaging such as X-rays and CT scans, for the pharmacy, for scheduling operating rooms and for tracking beds. Much of the clinical equipment, from infusion pumps to scanners, also talks to these systems.

Ransomware attacks rarely start with a dramatic break-in. More often the attackers find an unlocked door. In Düsseldorf’s case the widely reported route was a remote access gateway, the kind of product that lets a doctor check results from home or an equipment vendor service a scanner without visiting. Because these gateways must be reachable from the internet, they are probed constantly by criminals looking for known weaknesses. When a vendor publishes a fix, there is a race between the organizations installing it and the attackers trying to use the weakness first. The BSI’s warning after Düsseldorf described this flaw as known and actively exploited, which means that race was already under way.

Once inside, attackers typically move unnoticed from computer to computer, gather passwords, and then trigger the encryption across as many systems as they can reach at once. Staff arrive to screens they cannot use. Even systems that were not encrypted are often switched off deliberately, because nobody yet knows how far the attackers got. That precaution is sensible, and it also means the outage is usually wider than the damage.

Why patching was not enough

The Citrix flaw shows how an edge device becomes a door that stays open. After the vulnerability became public in December 2019, attackers scanned the internet for exposed gateways and exploited them at scale before many organizations could apply fixes. Some planted their own means of returning. When the hospital or its IT provider later installed the update, the original hole closed, but a foothold placed earlier could remain.

The operational response follows from that. Patching an internet-facing device that was exposed during a period of known exploitation is only the first step. The organization also has to look for signs of earlier compromise, reset credentials that passed through the device, and in some cases rebuild it from a clean image. That work competes with everything else on a hospital IT team’s list, and it produces no visible result when it finds nothing, which makes it easy to defer.

What downtime looks like on the ward

Hospitals plan for system outages, and their downtime procedures are real. Clinicians switch to paper orders and paper medication records. Read-only workstations, often called business continuity access machines, hold a recent snapshot of patient data so staff can see current medications and allergies. Runners carry lab results by hand. Pharmacists verify orders from paper.

Those procedures are designed for planned maintenance or a short unplanned outage, measured in hours. A ransomware attack strains them in three ways. The snapshot workstations may themselves be encrypted or switched off. The snapshot ages by the hour, so by day two it no longer reflects the patient in the bed. And the extra labor of paper work slows every task, which reduces how many patients the hospital can safely handle. That reduced capacity, more than the loss of any single system, is what pushes a hospital toward diversion.

Why recovery takes weeks

Recovery is slow because turning things back on is the easy part. Each system has to be checked, cleaned or rebuilt, and restored from backups that the attackers may also have tried to destroy. A capacity problem, such as a waiting room that is full on a Saturday night, can ease in hours. An encrypted hospital may be closed to ambulances for days or weeks, and at the start nobody can say how long.

The order is dictated by dependencies. Identity systems, the directory that decides who can log in to what, usually come first, because nothing else can be trusted until they are clean. The network and core infrastructure follow. Only then can the electronic health record and its interfaces to the laboratory, pharmacy and imaging systems be restored and tested. Connected clinical devices come last, often with vendor help.

Several things slow each stage. Forensic investigators need evidence preserved before systems are wiped, for insurers, law enforcement and regulators. Backups have to be checked for tampering before they are used. Once systems return, every paper record created during the outage has to be entered back into the electronic record, a task that can take staff weeks and that carries its own risk of error. A decryption key, as Düsseldorf had, shortens some of these steps but removes none of them.

A ransomware attack resembles a fire more than a burglary. The immediate damage matters, but so do the closures, the displaced people and the long, expensive rebuild. And just as a fire in one building can fill the hospitals of a whole town, a cyberattack on one hospital spills over to its neighbors.

What diversion moves, and to whom

When a hospital tells ambulances to go elsewhere, that is called diversion. Withdrawing from emergency care is usually the right call for a hospital that cannot see results, order medications electronically or track beds. It protects patients from arriving at a department that cannot work normally. It does not make the risk disappear. It hands that risk to three other parties.

• Patients with time-critical conditions. Stroke, heart attack, major trauma and sepsis all depend on minutes. A longer drive to the next suitable hospital is the most direct harm, and it falls on the patients least able to absorb it.
• Receiving hospitals. Neighbors take extra ambulances and walk-in patients with no warning in their staffing plans. Their waiting times rise, and their own capacity for specialty services, such as stroke teams or catheterization labs (the rooms where cardiologists open blocked heart arteries), is shared across a larger population.
• The ambulance service. Longer transports keep each crew out of service for longer. The same number of vehicles covers fewer calls, so response times can slip across the whole area, including for patients who never needed the affected hospital.

The affected hospital also keeps some of its burden. Inpatients may need transfer if critical systems stay down. Every transfer needs a clinical summary, the short account of who the patient is, what is wrong and what has been done, which the sending hospital may only be able to produce on paper.

Scheduled care moves too, and less visibly. Postponed operations join waiting lists at other hospitals or wait for the affected hospital to recover. Cancer patients whose radiation or chemotherapy planning depends on software may face delays. Dialysis, imaging and outpatient clinics that run on the same systems slow or stop. These patients do not arrive by ambulance, so diversion statistics miss them, but their care is delayed by the same attack.

Suppose a county has three hospitals and one ambulance service. On a Tuesday night, Hospital A is hit by ransomware and goes on diversion. Ambulances that would have made a twelve-minute trip to Hospital A now drive twenty-five minutes to Hospital B. Each of those trips keeps a crew busy for longer, so when a call comes in from the far side of the county, the nearest free ambulance is farther away than usual. Hospital B’s emergency department, staffed for a normal Tuesday, now has a queue in the corridor. Its stroke team is handling patients from two catchment areas. Nobody at Hospital B did anything wrong, and yet its patients wait longer and its staff work harder because of an attack on someone else.

A cyber diversion also behaves differently from the capacity diversions regions are used to. A full emergency department usually recovers within hours. A hospital whose systems are encrypted may be closed to ambulances for days or weeks, with no reliable estimate at the start. Regional arrangements built for short capacity diversions are not designed for that duration, and the strain on neighbors compounds day after day.

How diversion is governed, and how that differs by place

Diversion is not a hospital’s unilateral act. It operates within rules set by whoever runs emergency medical services in the area, and those rules differ.

In Germany, emergency medical services are organized under state law and largely run at district and city level, with integrated dispatch centers that route ambulances. A hospital that cannot take emergencies registers that with the dispatch center, which sends patients elsewhere. In the United States, diversion policies are typically set by local or regional EMS authorities, and they vary widely. Massachusetts, for example, largely ended ambulance diversion in 2009, requiring hospitals to manage surges internally rather than send ambulances away. Federal law adds another layer. Under EMTALA, a hospital that is on diversion still owes a screening examination and stabilizing care to patients who arrive at its emergency department anyway.

The type of hospital matters as much as the jurisdiction. When a community hospital diverts, nearby hospitals with similar services can usually absorb its patients. When a level 1 trauma center or comprehensive stroke center diverts, the specialized capacity it removes may not exist anywhere else nearby. A rural or critical access hospital may be the only emergency department for many miles, so its diversion means very long transports or none at all.

System consolidation changes the arithmetic further. Multi-hospital systems increasingly share one electronic health record and one network across all their hospitals. An attack that reaches that shared platform can take down every hospital in the system at once. A region that planned for one hospital diverting may face three or four, all owned by the same organization and all recovering on the same timeline.

What the region needs to know, and when

Regional partners can only absorb a diversion well if they get the right information early. In practice that means four kinds of signal, agreed in advance between hospitals, the ambulance service and the health authority.

1. Which services are affected. A hospital may lose imaging and laboratory systems while its operating rooms can still run. Partners need to know which specialty services are unavailable, because those determine where stroke, cardiac and trauma patients should go.
2. Expected duration, with honest uncertainty. A daily update that says what is known and what is not lets receiving hospitals adjust staffing. Silence pushes them to guess.
3. Transfer arrangements. Agreements on who accepts inpatient transfers, and what minimum clinical information travels with each patient when electronic records are unavailable.
4. Return to service. A clear signal when the hospital can accept ambulances again, and for which conditions, so traffic does not shift back before the department can cope.

These signals need a channel that does not depend on the affected hospital’s email or phone system. Security people call this “out-of-band” communication: a way of talking that sits outside the systems under attack. If a hospital’s phones run over the same network the attackers have just crippled, the hospital may be unable to tell anyone it is in trouble.

Many regions already run coordination centers for mass casualty events or seasonal surges, such as a bad flu winter. Adding a cyber diversion protocol to those arrangements costs far less than inventing one during an incident. The people already know each other, the contact lists already exist, and the decision rights are already clear. What is usually missing is the recognition that a cyberattack is one more reason a hospital may suddenly stop taking patients, and for much longer than usual.

The receiving side needs plans too. A hospital that might absorb a neighbor’s patients for a week should know how far it can stretch staffing and beds, and when it would itself need to divert. Exercising the scenario jointly, with the ambulance service present, tends to surface the practical gaps quickly. Typical gaps are a missing contact list, an unclear authority to declare diversion, or no agreed form for paper handoffs.

Attacker intent should play no part in these plans. In Düsseldorf the ransom note was reportedly aimed at the university, and the attackers handed over a key once told a hospital was affected. Neither fact helped the patients already on the road. A regional plan cannot rely on criminals keeping their word.

Who owns the protocol

A cyber diversion protocol needs an owner outside any single hospital. In the United States the natural home is often the regional health care coalition, the network of hospitals, EMS, public health and emergency management that HHS’s Hospital Preparedness Program funds. In Germany the equivalent responsibilities sit with state health ministries, district authorities and the dispatch centers. Whatever the structure, someone has to keep the protocol current, hold the contact lists and convene the exercises.

Within each hospital, the protocol should name roles rather than people: the incident commander who can declare diversion, the clinical lead who decides which services remain open, and the liaison who updates regional partners. On the EMS side, the medical director and the dispatch center supervisor need to know what a cyber diversion notice looks like and what it means for routing. Public health officials need to know when they will be told, because they will field questions from the press and elected officials.

Channels that survive the attack

Out-of-band communication has to be chosen and tested in advance. Common options include radio networks that link hospitals with EMS, satellite or cellular phones kept off the hospital network, a messaging service hosted independently of the hospital’s systems, and printed contact sheets. Each has costs. Radios and satellite phones need maintenance and practice. An independent messaging service needs accounts set up for the right people before an incident. Printed lists go out of date. The test of any channel is whether the people who need it can use it at three in the morning on the second day of an outage.

Exercising the scenario

A useful exercise program builds in stages. A tabletop exercise walks partners through the first hours: who declares, who is told, by what channel. A later exercise injects the conditions that make cyber diversion different, such as an update on day three saying recovery will take another week, or a second hospital reporting suspicious activity. Each exercise should produce a short list of fixes with owners and dates. The value lies in that list, and in rerunning the exercise to see whether the fixes held.

How to measure the harm honestly

Düsseldorf was first reported as a death caused by ransomware. When prosecutors concluded the delay was probably not decisive, some readers decided the risk had been overstated. Both reactions rested on a single case, which is a weak basis for judging a systemic risk.

The trouble with arguing from one case is that it turns a question about populations into a question about a person. Whether a particular patient would have lived with a shorter journey is often unknowable. Whether longer journeys, fuller waiting rooms and slower ambulance responses raise risk across thousands of patients is a question data can answer.

A better approach is to measure the regional effects directly, during and after every cyber diversion. Useful measures include:

• hours on diversion, by service line such as stroke, cardiac and trauma;
• additional transport time for ambulance patients;
• response times across the ambulance service’s whole area, including places far from the affected hospital;
• door-to-treatment times for stroke and heart attack at receiving hospitals, meaning the minutes between arrival and the start of the critical treatment;
• procedures postponed.

Two further measures capture the cost to neighbors. The first is staffing strain at receiving hospitals: overtime hours, agency staff called in and beds opened beyond normal capacity. The second is patients who leave an emergency department without being seen, a sign that waits have grown past what people will tolerate. Both are recorded routinely, both move quickly, and both show harm that falls on hospitals that were never attacked. Reporting them alongside the affected hospital’s own figures gives boards and regional planners the full picture of what one attack cost.

Most of this data already exists in ambulance and hospital records. It needs someone to collect it into one view, ideally the regional coordinator, with agreement in advance on what will be shared. Agreeing that during an incident, with lawyers on every side, is far harder.

The mechanics of a shared view

The data sources are familiar. Dispatch systems record when calls are received and when units arrive. Electronic patient care records hold transport times and destinations. Emergency department tracking systems record arrival, triage and disposition times. Stroke and cardiac programs already track door-to-treatment intervals for quality reporting.

The legal basis for sharing differs by jurisdiction. In the United States, HIPAA permits certain disclosures for public health and health oversight, and many of the measures above can be shared as aggregate counts and times with no patient identifiers at all. In Germany and elsewhere in the European Union, health data is a special category under the GDPR, and aggregate reporting avoids most of the difficulty. Either way, a data-sharing agreement signed in advance settles who receives what, in what form and for what purpose.

Baselines are the hard part. A cyber diversion has to be compared with what would have happened without it, usually the same weeks in earlier years or the weeks before the attack. In September 2020, with the pandemic distorting emergency volumes everywhere, any baseline was unreliable. Analysts should state the comparison they used and its weaknesses, rather than present a single number as settled.

What a single case can and cannot show

The Düsseldorf death illustrates why individual cases make poor evidence in either direction. Establishing that a specific delay caused a specific death requires showing that the patient would probably have survived with faster care. For a patient who was already critically ill, that is often impossible to show, and prosecutors need a high standard of proof. A finding that the delay was not decisive in one case says nothing about whether delays harm patients in general.

Population measures avoid that trap. Mortality is a lagging and noisy indicator, because deaths are relatively rare and have many causes. Process measures, such as transport times, door-to-needle times for stroke and door-to-balloon times for heart attack, move immediately and are already linked in clinical research to outcomes. A region that tracks them during a cyber diversion can show the harm as it happens, without waiting for a contested inquest.

Measurement matters for three decisions. Boards decide how much to spend on resilience, including redundant remote access, isolated backups and downtime tooling, and need evidence of what an outage costs patients. Regional planners decide how much surge capacity to hold. Public officials decide how to describe an incident, and accurate numbers protect credibility when the next one happens. A health authority that overstated the harm last time, or understated it, will find the public less willing to believe it next time.

Each cyber diversion should also be recorded as a patient safety event at both the affected and receiving hospitals. That routes it into the same review processes used for other systemic hazards, such as medication errors or falls, so it is not left as an IT incident report that clinical leaders never read.

The case against regional planning, and why it still holds

A skeptic could argue that cyber diversions are rare, and that money and attention are better spent preventing attacks than planning for their spillover. Regional coalitions in 2020 were also consumed by the pandemic, and adding another scenario to their list could look like a distraction.

Each point carries weight. Prevention does deserve the larger share of spending. But a cyber diversion protocol is cheap because it reuses structures that already exist, and its marginal cost is mostly a few meetings, contact lists and an annual exercise. The pandemic argument cuts the other way, too. Regions that ran surge coordination through 2020 and 2021 built exactly the relationships a cyber protocol needs. And the rarity argument has weakened with every year since, as the hindsight below records.

What the board answers for

A hospital board cannot treat cybersecurity as a technical matter delegated to the chief information officer. Düsseldorf shows why. The consequences of an attack land on patients, clinicians, the ambulance service, neighboring hospitals and the public’s trust in local health care. Those are board-level concerns.

The money is real, too. A hospital on diversion loses the revenue of the patients who go elsewhere, pays overtime for paper workarounds, and faces a long recovery bill. A receiving hospital absorbs costs it did not budget for. If a regional cyber diversion is never measured, none of these costs appear in the business case for prevention, and resilience spending looks like an optional extra rather than what it is: insurance against a known hazard.

Regulators and the public also judge institutions less by whether they were attacked than by how they behave in the crisis. A hospital that warned its neighbors quickly, kept the ambulance service informed and published honest figures afterward will be treated very differently from one that went silent. Reputation in health care is local and long-lived.

The obligations that already apply

Boards are not starting from nothing. In Germany, hospitals above a size threshold are designated critical infrastructure under the BSI Act and must report significant IT incidents to the BSI, which is how the Düsseldorf incident reached the agency. In the United States, the HIPAA Security Rule requires covered entities to have a contingency plan, including a data backup plan, a disaster recovery plan and an emergency mode operation plan. The CMS emergency preparedness requirements for hospitals call for an all-hazards risk assessment, a communication plan, and regular training and exercises.

No rule among these explicitly requires a regional cyber diversion protocol. Each provides a hook for one. A board can ask management to show where cyber diversion appears in the hospital’s all-hazards risk assessment, how the communication plan works without hospital systems, and when the last exercise included regional partners. Those questions turn an abstract obligation into evidence the board can review.

Ownership and funding shape the response

Who governs the hospital, and who pays, differs by type of hospital. University Hospital Düsseldorf is a public institution of the state of North Rhine-Westphalia, so its oversight runs in the end to state government. In Germany, hospital funding is split: the states are responsible for investment costs, including much IT infrastructure, while health insurers pay for operating costs through case-based payments. Hospital associations had long argued that state investment funding fell short, and IT security competed with buildings and equipment for the same limited money.

In the United States, the picture varies by ownership. Nonprofit systems answer to boards of trustees and to bond investors who read their disclosures. For-profit systems answer to shareholders and the SEC. Public hospitals answer to counties, cities or states, and often face procurement rules that slow urgent purchases. Each structure changes how quickly a board can fund remote access hardening or backup isolation, and who must approve it. Knowing that path in advance matters, because the time to argue over funding is before an incident, not while a hospital is on paper.

A prepared region, and the plans that fail

Good preparation is not exotic. In a well-prepared region, the hospitals, the ambulance service and the health authority have agreed a short cyber diversion protocol that sits inside their existing surge plans. Each hospital knows who can declare diversion and how to tell partners without its own email. There is a one-page paper transfer summary everyone recognizes. Receiving hospitals know their stretch limits. Once a year the partners rehearse a multi-day outage together, and afterward they fix what broke.

The ways plans fail are just as recognizable:

• Planning for hours, not weeks. Downtime plans written for a short system outage fail on day three.
• Planning alone. A hospital that rehearses only internally never tests the handoffs with the ambulance service and neighbors, which is where diversion actually happens.
• Relying on systems the attack will take down. Contact lists stored on the shared drive, phone systems on the same network, plans kept only as electronic documents.
• Treating it as an IT event. If clinical leaders and the emergency department are not in the room, the plan will describe servers rather than patients.
• Arguing from anecdote. Judging the risk by whether one famous case caused a death, instead of collecting the regional data that shows the pattern.

Prevention still matters most. Patching internet-facing gateways quickly, keeping backups that attackers cannot reach and rehearsing restoration all reduce the chance and the length of a diversion. But no hospital can guarantee it will never be hit, which is why the regional plan is the second line of defense rather than an afterthought.

The regional plan should also name critical suppliers. Hospitals depend on outside laboratories, teleradiology reading services, pharmacy wholesalers and transcription vendors. An attack on one of those suppliers can force several hospitals into partial diversion at once, even though the attackers never touched their networks. Listing those dependencies, and agreeing who will tell partners when a shared supplier goes down, extends the same protocol to a risk that is easy to overlook.

Trade-offs in the fixes

The preventive fixes carry costs that boards should weigh openly. Tightening remote access with stronger authentication and fewer exposed gateways adds friction for clinicians who check results from home and for vendors who maintain equipment remotely. Segmenting the network so that an attack on one part cannot reach clinical devices costs money and engineering time, and it can complicate the integrations clinicians depend on. Keeping backups that attackers cannot reach means paying for separate infrastructure and testing restores that may never be needed.

The diversion decision has trade-offs of its own. A hospital that diverts early protects incoming patients but pushes load onto neighbors sooner. One that tries to stay open on paper may keep the region’s burden down for a while, at some risk to its own patients. Neither choice is right in every case. Criteria agreed in advance with clinical leaders and regional partners make the decision faster and easier to defend afterward.

Regional preparation before the next attack

Whether you lead a hospital, an ambulance service or a regional health authority, these questions will tell you quickly where you stand.

• If our main systems went down tonight, who would decide to divert ambulances, and how would they tell the ambulance service and our neighbors if our email and phones were down?
• Does our regional surge plan mention a cyberattack at all, and does it assume an outage of hours or of weeks?
• What paper summary travels with a patient we transfer when our records are unavailable, and have our neighbors seen it?
• Who would collect transport times, response times and treatment times across the region during a cyber diversion, have we agreed in advance to share them, and would we record the diversion as a patient safety event?
• When did we last rehearse a multi-day outage with the ambulance service and neighboring hospitals in the room, and what did we fix afterward?

These questions apply in different measure to each party. A hospital leader should own the first and third. An ambulance service should own the measurement and the routing rules. A regional authority or coalition should own the exercise and the shared protocol. Where nobody owns a question, that gap is the first thing to fix.

The answers are rarely flattering the first time, which is why the time to ask is before an attack rather than after one.

With hindsight

Cyber diversion became a recurring feature of hospital incidents. Large U.S. health systems hit by ransomware in 2021, 2022 and 2024 diverted ambulances or postponed care at some facilities, in some cases for weeks. What looked in 2020 like a rare German event turned into a familiar pattern.

The pattern began within weeks of Düsseldorf. The attack on Universal Health Services in late September 2020 forced its facilities onto paper and disrupted care, and the company later estimated its pre-tax losses from the incident at about $67 million. In May 2024 Ascension, one of the largest U.S. health systems, diverted ambulances from some of its hospitals after a ransomware attack. In June 2024 an attack on Synnovis, a pathology provider serving several London NHS trusts, led to thousands of postponed appointments and operations and an urgent appeal for blood donors. A supplier outage had become a regional emergency.

One hope from 2020 did not hold. Early in the pandemic, some ransomware groups publicly said they would avoid attacking hospitals. Attacks on health care continued through the pandemic and beyond, and Düsseldorf turned out to be an early example rather than an exception.

The evidence caught up with the intuition. A study published in JAMA Network Open in 2023 examined emergency departments near a San Diego health system attacked in 2021. It reported higher volumes, more ambulance arrivals and longer waits at the neighboring hospitals. That supports the regional view of the risk: an attack on one hospital is felt across its region. It also shows that regional measurement is possible, using records that already exist.

The study’s numbers are worth stating. During the four weeks after the May 2021 attack on a four-hospital San Diego system, ambulance arrivals at two neighboring emergency departments rose by about 35 percent compared with the four weeks before. Median time from arrival to a treatment room rose from 21 to 31 minutes. The number of patients who left without being seen more than doubled. Stroke code activations rose from 59 to 103, and county diversion hours rose sharply. The attacked system accounted for about a quarter of the county’s acute inpatient discharges, which is why the spillover was so large.

Policy moved in the same direction. HHS’s voluntary cybersecurity performance goals for the health sector, published in January 2024, emphasize incident planning. The same year, the attack on Change Healthcare showed that shared infrastructure can disrupt care far beyond one region. When a company that many providers depend on goes down, the spillover is not regional but national, and the planning question grows accordingly.

Germany moved too. The Hospital Future Act of 2020 funded a hospital modernization program that required a share of each funded project to go to IT security. From 2022, German social insurance law extended IT security obligations to hospitals below the critical infrastructure threshold. The EU’s NIS2 Directive, adopted in 2022, brought many more health care providers into its cybersecurity and incident reporting regime, although Germany missed the October 2024 deadline for writing it into national law. In the United States, HHS proposed changes to the HIPAA Security Rule in January 2025 that would, among other things, require regulated entities to be able to restore critical systems within 72 hours.

Progress on the specific fix has been patchy. Regional cyber diversion protocols and shared measurement remain uneven by 2026. Where they exist, they usually grew out of emergency preparedness coalitions, the groups that already plan for disasters and mass casualty events, not hospital IT departments. That is telling. The regions that have made progress are the ones that treated a cyberattack as one more kind of emergency, with the same people, the same coordination centers and the same habits of rehearsal.

The practical reading is straightforward. Ask whether your region’s emergency planners have a cyber scenario on their list, and if not, put it there. Make sure your hospital can talk to its neighbors when its own systems are dark. And collect the numbers every time, so that the next debate about the cost of an attack rests on evidence rather than on a single, disputed story.