A micro-level perspective

The six categories of attack outlined above permit indirect inferences about the on-the-ground impacts of cyberattacks. First, tar­gets of attacks in the healthcare sector are highly diverse, ranging from hospitals, medical practices, pharmacies and medical-device manufacturers to insurance companies, emergency medical services, pharmaceutical companies and non-governmental organisations. Depending on the organisation affected, the method and route of attack (the so-called attack vector), and the scale of the attack (including the number and type of systems and facilities affected), the implications for public health can vary considerably. The criticality of a healthcare facility can be assessed through its size, care mandate, location, specialisation and the availability or absence of alternatives.

In the following, the identified cyberattack clusters (C0–C5) are ranked in ascending order of their impact on healthcare provision:

1. Data theft/encryption (e.g. patient data, insurance numbers or bank details)

2. Disruption to IT services (e.g. website, appointment portals or communications)

3. Disruptions to operational systems and services (e.g. hospital information systems, sterilisation services, radiology or laboratory systems, blood banks).

Together with information about the affected facility or facilities and the temporal dimen­sion, it is possible to assess the specific impacts on healthcare provision. EuRepoC data show that cyberattacks impacting diagnostic processes (e.g. laboratories or radiology) or operational processes (e.g. sterilisation, patient admissions or documentation) have serious consequences for healthcare provision. One example is the cyberattack on the Luigi Vanvitelli University Hospital in Italy in 2023, where the resulting shift to manual processes led to noticeable capacity constraints (C4).

By contrast, attacks aimed solely at stealing patient data are often associated with a loss of information or trust. In 2025, for example, sensitive data were stolen from the UK healthcare provider HCRG Care Group and partly published on the dark web (C2). In 2023, the data of more than one million patients were stolen from the medical device manufacturer Zoll (C1). Even though attacks aimed at data theft theoretically have no direct impact on the delivery of healthcare, they can also disrupt it indirectly if protective measures require systems to be disconnected from the network or certain services to be shut down. This occurred in 2025 at SimonMed, which employs 200 radiologists across 170 sites in 11 US states (C2).

Well-known criminal threat actors, such as BianLian, Medusa, BlackCat and LockBit, which openly claim responsibility, often do so in connection with ransomware attacks to extort the affected organisations. In 2023, for example, the service provider TransForm Shared Service Organization was attacked by the DAIXIN team, which indirectly affected patient care and appointment scheduling at five hospitals in the Canadian province of Ontario (C1). In 2024, the Swiss pharmaceutical company Octapharma was forced to temporarily close more than 150 plasma donation centres in the United States follow­ing an attack by the BlackSuit group (C2). Although some attackers such as LockBit claim that they would not target the health­care sector, the data paint a different pic­ture. In addition to hospitals, the most frequent targets are larger medical practices and service providers such as insurance companies and medical-device companies. Even non-governmental organisations are targeted, as the case of Omni Family Health (C1) demonstrates.

Hospitals can sometimes respond quite quickly to disruptive attacks by implementing analogue contingency procedures, as examples from 2024 at Lindenbrunn Hospital in Coppenbrügge (C4) and from 2025 at Stell Hospital in France (C4) demonstrate. At the same time, these measures also entail restrictions, meaning that appointments or scheduled procedures may have to be post­poned during an attack, as occurred following an attack on the hospitals in Lippstadt, Erwitte and Geseke in 2024 (C4). Whether these were purely precautionary measures cannot be determined from publicly available reports. However, when three hospitals operated by the Katholische Hospitalvereinigung Ostwestfalen gGmbH were forced to suspend emergency care services (C4) on Christmas Eve 2023, and when operations were postponed at the Wertachkliniken in Bobingen and Schwabmünchen (C4) in 2024, these actions were taken as a precaution. One thing is clear: Greater transparency regarding the threat situation enables more closely coordinated crisis and emergency management.

Additionally, when hospitals are taken out of emergency care provision because of a cyberattack, ambulances may have to be diverted. This occurred in 2023 after an attack on the US company Ardent, which operates more than 30 hospitals and had to temporarily suspend services for 10 emergency rooms (C4), and in 2024, when two hospitals in Milan were no longer served by ambulances (C4). In rural areas, such cases can entail significantly longer transport times, which can result in harm to patients.

Attacks that affect central systems within a hospital network or a healthcare group are particularly serious. The resulting cascading effects can compromise the systems of multiple institutions at once. One example is the attack on the Hipocrate Information System in Romania in 2024, which resulted in 25 hospitals switching to analogue methods and a further 75 facilities disconnecting from the platform as a precautionary measure (C4). Disruption affecting sup­pliers, emergency medical services or phar­macies can also have a significant impact on healthcare provision. This is illustrated by the outage of an emergency dispatch centre in Bolzano in 2025 (C0) and two Russian pharmacy chains that temporarily closed around 1,000 branches in 2025 (C0).

Such vulnerabilities are likely to increase in the future. In Germany, this is partly because the shift towards centre-based healthcare, including under the Hospital Care Improvement Act, entails the centralisation of information systems. Furthermore, restoring systems after a cyberattack is likely to result in longer-term restrictions on service provision. This, in turn, places an additional burden on alternative local health­care providers. Such service restrictions caused by cyberattacks would have serious consequences in a so-called twin threat scenario, for example during a military con­flict or an extreme-weather event such as a heatwave.

The clustering of the EuRepoC data and the outlined consequences of cyberattacks on healthcare provision make one point clear: Even where attack patterns are similar, attacks can have differing disruptive impacts. Overall, attacks classified in C3 and C5 have less severe impacts on healthcare provision than those classified in C0, C1 and C4, while attacks in C2 fall somewhere in between. However, attacks within a given cluster can also vary considerably, which means that each case must be assessed individually.

The potential role of WHO at the macro level

The cyberattack clusters and consequences identified at the micro level regularly have an international dimension. The attack on Stryker simultaneously halted production sites in Cork, Tuttlingen and Mühlheim; the incident at Octapharma forced the temporary closure of more than 150 plasma dona­tion centres; and the outage of the Hipocrate Information System affected more than 100 healthcare facilities. Cyberattacks on the healthcare sector and supply chain thus have impacts that cross national and sectoral boundaries. Systematic monitoring of these cross-border impacts and ripple effects require an institution with a global perspec­tive and clinical expertise that can assess, in an integrated manner, the consequences of cyberattacks for healthcare provision.

The World Health Organization (WHO) is the central body responsible for coordinating global health efforts and assessing health risks. Through its Surveillance System for Attacks on Health Care (SSA), it already has an institutionally suitable model, although its current mandate is limited to kinetic (physical) attacks in humanitarian emergencies. Extending the SSA’s mandate to the cyber domain would close a critical gap, as existing security-focused registries are unable to capture the specific and sometimes cross-border impacts of cyberattacks on healthcare provision; they lack the necessary specialist expertise. EuRepoC provides reliable information on attack vectors, attribution and technical intensity, but does not provide details about the impacts on healthcare provision. The Emer­gency Events Database (EM-DAT) and the Global Terrorism Database (GTD) do not capture digital forms of attack or the sector-specific criticality of healthcare facilities.

Since 2017, WHO’s SSA has also recorded attacks that result in an obstruction to health­care delivery. To date, however, it has been limited to kinetic attacks and to those occurring in “complex humanitarian emer­gencies”. The crisis register of the German Working Group on Hospital Contingency Planning (DAKEP) alone covers exceptional situations, including IT incidents in hos­pitals. However, it only covers Germany, Austria, Switzerland and Luxembourg; moreover, incidents are reported by the institutions themselves and, in most cases, only retrospectively.

Unless cyberattacks and their consequences for healthcare are systematically recorded and assessed, patterns of impact will remain anecdotal, and the development of protection standards will continue to lack systematic evidence. Furthermore, the political accountability of states from whose territory cyberattacks originate (i.e. those that direct or at least tolerate threat actors) remains limited. Recording and publicly identifying attacks globally, and assessing their consequences for healthcare provision, is therefore not merely an analytical necessity but also a necessity for health and security policy.

WHO could bridge this existing gap, as it combines health expertise with global reach. Assessing the impact of cyberattacks on the healthcare sector from a comprehensive global perspective is particularly relevant, as concentration risks, cascading effects and twin threats identified at the micro level have cross-border implications. Through its network of regional offices, WHO has the reach required by this transnational logic of impact. Its work to protect healthcare facil­ities also gives it the legitimacy that is essential to a cyber-monitoring mandate. The fact that WHO now explicitly classifies cyberattacks on critical health infrastructure as attacks on health facilities underscores this reasoning.

With the SSA, WHO has an established platform for precisely this task of monitoring the impacts of cyberattacks on health­care systems. The SSA serves three closely linked purposes: It raises global awareness about targeted attacks on healthcare provision; it provides a database for evidence-based prevention and protection standards; and it promotes accountability by identifying and documenting attacks on healthcare facilities as such. These three functions are as relevant to cyberattacks as they are to kinetic attacks and are vital beyond the existence of an armed conflict.

World Health Assembly resolution WHA 65.20, which sets out the SSA’s mandate, employs a broad definition of attack, referring simply to “attacks”. Under international humanitarian law, attacks on health infrastructure generally also include digital attacks: a cyberattack that renders a hospital inoperable is not fundamentally different in its effects from a physical attack. The necessary conceptual basis is therefore established. The mandate itself, however, remains limited to attacks in complex humanitarian emergencies. Expanding the SSA to include a cyber module that is not subject to this condition would be the logical next step towards closing the identified gap.