Researchers reviewed 59 case studies and 3,408 health forums, finding harms recorded nowhere in formal reporting systems.

 

What happened

A systematic review published in the Journal of Medical Internet Research on September 28, 2026 identified 316 distinct patient-level harms during hospital cyberattacks, drawn from 59 peer-reviewed case studies across 13 countries and from patient and staff accounts posted online, in research led by Isabel Straw, MPH, MD, PhD, of the University of California San Diego. The team searched five medical databases for studies published between 2004 and July 2026, then ran a separate analysis mining 3,408 health-related forums for discussion of named ransomware strains, with clinicians reviewing each post for relevance. The academic studies yielded 132 harms. The online accounts added a further 184. The authors describe it as the first synthesis of cyberattack harms viewed through a clinical rather than a technical lens.

 

Going deeper

Two groups of patients emerged as most at risk, and they are at risk for different reasons. The first covers time-critical conditions, where delays of minutes to hours change the outcome, including stroke, cardiac arrest, sepsis, and major trauma. The second is less recognized and covers patients who depend on digital systems for routine care while also being capable of deteriorating quickly, including people with cancer, people with diabetes, and anyone reliant on community prescribing. A patient with trauma is unlucky to arrive during an attack. A patient arriving in diabetic crisis may be there because the attack cut off their outpatient monitoring and medication supply weeks earlier. The authors argue that the most severe harms come from several digital failures happening at once across different parts of a health system rather than from any single system going down.

 

What was said

The boundary between cybersecurity and patient safety "has ceased to exist, demanding unified frameworks that treat digital resilience and clinical preparedness as two expressions of the same obligation," the authors wrote in their conclusion. They state that cyberattack preparedness should be understood as a patient safety matter rather than an IT governance one, and that the patients most harmed are not always those visible in conventional safety metrics.

 

In the know

Specific technical failures mapped to specific clinical outcomes resulted in several immediate consequences. Compromised linear accelerators, the machines delivering radiation therapy, produced oncological harm, with researchers describing cancer patients mid-course through fractionated radiation whose lost treatment records risked tumour regrowth. Failures in digital templating software left orthopaedic surgeons unable to select implant size and position. Telemetry failures were linked to fetal deaths, with one account describing a monitor tracking the mother's heart rate while staff believed they were watching the baby's. The online data surfaced categories absent from the published literature entirely, including door access systems blocking staff from reaching patients, ward alarm failures, loss of closed-circuit television on psychiatric wards, and suspended home treatment services. Harms in emergency medicine, surgery, and oncology dominated the academic studies, while psychiatry, neurology, and obstetrics appeared far more often in the forums.

 

The big picture

Adverse events during an attack are typically reported through the same system the attack disabled, which is the reporting gap this study was designed around. The authors cite work finding systematic data on near misses and patient outcomes during downtime simply unavailable, and note that staff were more forthcoming online than through formal channels, with some stating they were discouraged from reporting at all for fear of losing their jobs. That has a practical consequence for any organization writing a downtime plan, because the harms it most needs to anticipate are the ones least likely to appear in its own incident records. The team has published the underlying data as an open dataset linking technical failure types to clinical risks, available alongside the paper, which gives preparedness planning a starting point that does not depend on an organization having been attacked already.

 

FAQs

Why use social media data in a medical systematic review?

Because the formal reporting route fails during exactly the period under study. Electronic incident reporting goes down with everything else, escalation pathways become unclear, and staff face pressure not to report. Posts written during an attack capture events that never entered any record.

 

What makes a patient digitally dependent?

Reliance on connected systems for routine care rather than for emergencies, such as continuous glucose monitors, scheduled infusions, electronic prescribing for chronic conditions, or remote monitoring. Those patients lose maintenance care first and may then present acutely at a hospital already operating without its systems.

 

How can a hospital identify its own at-risk groups?

By working through which services depend on which systems, then asking which patients deteriorate fastest when each one is unavailable. The study's framework groups harms by clinical specialty specifically so that preparedness planning can start from the patient rather than the server.

 

Does this change what a downtime plan should contain?

It suggests the plan needs cross-departmental input before an incident, since the worst outcomes came from simultaneous failures across departments that each planned separately. It also points toward tracking which patients lost scheduled care, because those harms surface weeks or months later.

 

What is the CIPHER dataset?

An open-source record published with the study, cataloguing each identified harm with its source, description, and clinical specialty, and linking technical failure types to the clinical risks that followed. It is intended for reuse in research and preparedness planning.