A study found that cyberattacks targeting hospitals can go beyond simple system outages and lead to patient deaths, treatment interruptions and leaks of sensitive medical information. It also said hospital security should be treated not as an IT issue but as a safety issue directly tied to patients' lives.

ITmedia, a Japanese outlet, reported on Nov. 10 that researchers including a team from the University of California, San Diego published the analysis in the international journal Journal of Medical Internet Research.

The researchers analysed 59 academic papers published in 13 countries and accounts of patient and medical staff experiences posted on the online community Reddit. They compiled 316 cases and types of patient harm, including 132 incidents identified in the papers and 184 collected from Reddit posts.

The most dangerous group was emergency patients who need rapid treatment, such as those suffering strokes, cardiac arrest and severe trauma. When networks are paralysed, checking test results and delivering treatment are delayed. The influx of emergency patients to nearby medical facilities also increased the burden on the broader healthcare system.

A separate U.S. analysis cited in the study estimated that in-hospital mortality among patients already admitted when a ransomware attack began rose by 34 to 38 percent. Another case showed that among out-of-hospital cardiac arrest patients near an attacked hospital, the share who survived without severe brain damage plunged from 40 percent to 4.5 percent.

Cancer and diabetes patients were also vulnerable. Reported cases included treatment being halted when radiation therapy equipment and chemotherapy management systems stopped, as well as disruptions to blood glucose meter sensors and supplies of prescribed drugs.

In operating rooms, surgeries were delayed or cancelled because staff could not review MRI and CT images or access sterilisation records for medical devices. Medical staff also said first aid was delayed due to failures in hospital phones, pagers and access control systems.

Damage from personal data leaks was also serious. In the United States, body photos of breast cancer patients were leaked to the dark web. In Finland, stolen psychotherapy records were misused to blackmail patients.

The researchers stressed the need to manage hospital cybersecurity and the assurance of continuity of care in an integrated manner. They added that the study included various observational studies and online accounts, making it difficult to generalise the presented cases as the average level of risk across all hospitals.