The sector where a breach is measured in minutes

Why is an outage here different?

Every organisation says it cannot afford downtime. Most are describing revenue. A hospital is describing a queue of people whose conditions continue to develop while the queue does not move, which is a different kind of clock and the reason extortion finds this sector so productive.

The mechanism of harm is worth being precise about, because it is not what the phrase "hospital hacked" suggests. Nobody adjusts a ventilator. What happens is that the record system goes down, and with it the ability to know what a patient is allergic to, what they were prescribed last week, what their last scan showed and what their bloods said this morning. Clinicians continue working, more slowly and with less information, and the accumulated effect of many small delays across many patients is measurable in outcomes.

That is what the mortality finding describes. The increase of roughly a third among patients already admitted when an attack begins is not a story about anybody being targeted; it is what happens when an entire institution loses several days of precision at once. The same research puts the estimate at a few dozen preventable deaths across five years in one country's Medicare population alone — a small number against national mortality and an enormous one against the way this subject is usually costed.

There is also a reason the disruption lasts. Bringing systems back is not the end of it: every appointment cancelled during the outage still needs to happen, every procedure postponed joins a waiting list that was already long, and the backlog is worked through at the same rate as everything else. An average disruption of about sixteen days to care delivery understates the recovery, which continues quietly for months.

The medical device question

Connected medical equipment attracts more coverage than any other part of this subject, and the reason is narrative rather than evidential. A compromised infusion pump is a vivid and frightening image. It is also, so far, an unusual event, while the encrypted record system that slowed an entire hospital for a fortnight is common and hard to photograph.

The genuine device problem is duller and larger. A hospital runs thousands of connected things — scanners, monitors, pumps, analysers — bought over two decades, certified in the configuration they shipped with, and frequently running operating systems whose support ended years ago. They cannot be patched without revisiting the certification, they cannot be replaced without a capital programme, and they sit on the same network as everything else because that is how they were installed.

Which makes the answer the same as in any plant: change the surroundings rather than the device. Put the equipment where only what needs to reach it can, accept that it will remain vulnerable, and monitor for it behaving unlike itself. Regulators have moved in this direction too, with expectations that manufacturers ship equipment that can be updated and disclose what is inside it, which helps for machines bought from now on and does nothing for the scanner installed in 2014. The archive's earliest device piece, FDAnews Announces — Software and Cybersecurity Risk Management for Medical Devices Workshop, April 14-15, 2015, was already making the point about equipment lifespan.

Who pays when the harm lands next door?

Nobody, in any formal sense, and that is the structural problem underneath everything on this page. The hospital that was attacked bears its own recovery cost and will report it. The hospital that absorbed its ambulances bears longer waits, a stretched rota and worse outcomes for its own patients, and there is no instrument anywhere that records this as a cost of the attack.

This is a familiar shape in other fields. An externality is a cost created by one party and paid by another, and the standard remedies are regulation, liability or insurance. None of the three currently reaches this case. Health regulators assess organisations individually against their own obligations; liability requires somebody to have been negligent toward a party they owed a duty to, which the neighbouring hospital is not; and insurance covers the policyholder.

The practical consequence is that the party best placed to reduce the regional harm has the least reason to spend on it. A hospital investing in faster recovery is buying a benefit that partly accrues to institutions down the road, which is exactly the condition under which economists expect underinvestment — and exactly what the sector's spending patterns look like.

Where this has been addressed at all, it has been through regional coordination rather than through anybody's security budget: shared arrangements for capacity information, agreed diversion protocols, and in a few places a regional body that funds resilience across facilities rather than leaving each to argue for it alone. Those arrangements are unglamorous, cheap relative to the harm, and consistently nobody's responsibility until after an incident makes them somebody's.

The supplier no patient has heard of

A hospital's dependencies extend well past its own walls, and the ones that matter are frequently invisible to everybody using the service. Claims clearing, pharmacy eligibility checks, transcription, imaging archives, laboratory interfaces and appointment systems are often operated by third parties, sometimes by a single third party across a large share of a country's providers.

The 2024 attack on a payments clearing house demonstrated what that concentration means. The company was unknown to the public, sat between patients and their prescriptions, and its outage stopped pharmacies dispensing and providers being paid across an entire national system — eventually reported as affecting around 193 million people. No individual hospital had made a bad decision. Each had contracted with a normal supplier for a normal service, and the aggregate was a single point of failure nobody had chosen.

Concentration of this kind is hard to address from inside one organisation, because the alternatives are frequently the same supplier under a different name, or do not exist. The realistic move is to know which dependencies would stop clinical work and to have a manual path for each — a way to dispense without eligibility checking, a way to receive results without the interface — rather than to pretend the dependency can be removed.

It also argues for asking a question that procurement rarely covers: what happens to us if this supplier is down for two weeks. Contracts reliably specify uptime and penalties, which compensate for a loss rather than preventing it, and a penalty clause has never yet dispensed a prescription. The useful contract term is not the service level but the obligation to tell you promptly when the service has gone, and to keep telling you while it is away.