When a hospital diverts, the whole region absorbs the attack

The week

On the night of September 9 to 10, 2020, a ransomware attack disrupted systems at University Hospital Düsseldorf in Germany. The hospital withdrew from emergency care while it recovered, and planned operations were postponed. Germany’s federal cybersecurity agency said the intrusion had exploited a known vulnerability in Citrix remote access software.

A woman needing urgent care was taken by ambulance to a hospital in Wuppertal, farther away, and died. Prosecutors opened an investigation into whether the attackers could be held responsible. It was widely reported that the ransom note was addressed to the affiliated university, and that the attackers supplied a decryption key after police told them a hospital had been hit. Prosecutors later concluded that the delay was unlikely to have been decisive in the patient’s death.

Earlier in this series we looked at the Citrix flaw itself, and at why internet-facing gateways are a hospital’s most exposed systems. Düsseldorf adds a different point. Once a hospital loses its core systems and closes its doors to ambulances, the incident stops being one organization’s problem. Patients travel farther, neighboring emergency departments fill, and the ambulance service runs longer trips with the same fleet. Few regions in 2020 planned for that as a cyber scenario. Fewer still measured what it cost. We take the problem in three parts: what diversion moves, what the region needs to know and when, and how to measure the harm honestly.

What diversion moves

Withdrawing from emergency care is usually the right call for a hospital that cannot see results, order medications electronically or track beds. It protects patients from arriving at a department that cannot work normally. It does not make the risk disappear. It hands that risk to three other parties.

• Patients with time-critical conditions. Stroke, heart attack, major trauma and sepsis all depend on minutes. A longer drive to the next suitable hospital is the most direct harm, and it falls on the patients least able to absorb it.
• Receiving hospitals. Neighbors take extra ambulances and walk-in patients with no warning in their staffing plans. Their waiting times rise, and their own capacity for specialty services, such as stroke teams or catheterization labs, is shared across a larger population.
• The ambulance service. Longer transports keep each crew out of service for longer. The same number of vehicles covers fewer calls, so response times can slip across the whole area, including for patients who never needed the affected hospital.

The affected hospital also keeps some of its burden. Inpatients may need transfer if critical systems stay down. Every transfer needs a clinical summary that the sending hospital may only be able to produce on paper.

A cyber diversion also behaves differently from a capacity diversion. A full emergency department usually recovers within hours. A hospital whose systems are encrypted may be closed to ambulances for days or weeks, with no reliable estimate at the start. Regional arrangements built for short capacity diversions are not designed for that duration.

What the region needs to know, and when

Regional partners can only absorb a diversion well if they get the right information early. In practice that means four kinds of signal, agreed in advance between hospitals, the ambulance service and the health authority.

1. Which services are affected. A hospital may lose imaging and laboratory systems while its operating rooms can still run. Partners need to know which specialty services are unavailable, because those determine where stroke, cardiac and trauma patients should go.
2. Expected duration, with honest uncertainty. A daily update that says what is known and what is not lets receiving hospitals adjust staffing. Silence pushes them to guess.
3. Transfer arrangements. Agreements on who accepts inpatient transfers, and what minimum clinical information travels with each patient when electronic records are unavailable.
4. Return to service. A clear signal when the hospital can accept ambulances again, and for which conditions, so traffic does not shift back before the department can cope.

These signals need a channel that does not depend on the affected hospital’s email or phone system. Many regions already run coordination centers for mass casualty events or seasonal surges. Adding a cyber diversion protocol to those arrangements costs far less than inventing one during an incident.

The receiving side needs plans too. A hospital that might absorb a neighbor’s patients for a week should know how far it can stretch staffing and beds, and when it would itself need to divert. Exercising the scenario jointly, with the ambulance service present, tends to surface the practical gaps quickly. Typical gaps are a missing contact list, an unclear authority to declare diversion, or no agreed form for paper handoffs.

Attacker intent should play no part in these plans. In Düsseldorf the ransom note was reportedly aimed at the university, and the attackers handed over a key once told a hospital was affected. Neither fact helped the patients already on the road.

How to measure the harm honestly

Düsseldorf was first reported as a death caused by ransomware. When prosecutors concluded the delay was probably not decisive, some readers decided the risk had been overstated. Both reactions rested on a single case, which is a weak basis for judging a systemic risk.

A better approach is to measure the regional effects directly, during and after every cyber diversion. Useful measures include hours on diversion by service line, additional transport time for ambulance patients, response times across the ambulance service’s area, door-to-treatment times for stroke and heart attack at receiving hospitals, and procedures postponed. Most of this data already exists in ambulance and hospital records. It needs someone to collect it into one view, ideally the regional coordinator, with agreement in advance on what will be shared.

Measurement matters for three decisions. Boards decide how much to spend on resilience, including redundant remote access, isolated backups and downtime tooling, and need evidence of what an outage costs patients. Regional planners decide how much surge capacity to hold. Public officials decide how to describe an incident, and accurate numbers protect credibility when the next one happens.

Each cyber diversion should also be recorded as a patient safety event at both the affected and receiving hospitals. That routes it into the same review processes used for other systemic hazards, so it is not left as an IT incident report.

With hindsight

Cyber diversion became a recurring feature of hospital incidents. Large U.S. health systems hit by ransomware in 2021, 2022 and 2024 diverted ambulances or postponed care at some facilities, in some cases for weeks. A study published in JAMA Network Open in 2023 examined emergency departments near a San Diego health system attacked in 2021. It reported higher volumes, more ambulance arrivals and longer waits at the neighboring hospitals, supporting the view that an attack on one hospital is felt across its region.

Policy moved in the same direction. HHS’s voluntary cybersecurity performance goals for the health sector, published in January 2024, emphasize incident planning, and the 2024 Change Healthcare attack showed that shared infrastructure can disrupt care far beyond one region. Regional cyber diversion protocols and shared measurement remain uneven by 2026. Where they exist, they usually grew out of emergency preparedness coalitions, not hospital IT departments.