A German woman has died after being diverted from a hospital that had suffered a ransomware attack, allegedly the first death attributed directly to such an attack.

The ransomware attack targeted the Duesseldorf University Hospital Sept. 10, resulting in critical systems at the hospital being shut down. As a result of the outage, patients seeking emergency care were diverted to a hospital in Wuppertal, 32 kilometers (20 miles) away. The diversion delayed treatment of the woman by about an hour and doctors were unable to treat her in time to save her.

The form of ransomware used in the attack was not disclosed, but local officials said that it affected 30 servers. The ransomware infection path is said to have involved the attackers exploiting a vulnerability in a “widely used commercial add-on software.” Ars Technica reported that around the same time, the CERT-Bund, the German cybersecurity authority, tweeted a link to a security advisory from January relating to a critical vulnerability in the Citrix application delivery controller.

Data was encrypted on affected servers, but atypically for a ransomware attack, a set ransom was not demanded. Those behind the attack instead asked for the addresses to get in touch. According to the Associated Press, the letter was addressed to the Heinrich Heine University, which the Duesseldorf hospital is affiliated with but not to the hospital.

Authorities then reached out to those behind the attack and told them that the hospital and not the university had been affected, endangering patient lives. Perhaps proving that sometimes cybercriminals do have a heart, the perpetrators withdrew their demands for a ransom and provided a key to decrypt the data.

German authorities have launched an investigation against those behind the ransomware attack on suspicion of negligent manslaughter.

Ransomware attacks targeting hospitals have been increasing this year amid the COVID-19 pandemic. Fresenius SE & Co. KGaA, Europe’s largest private hospital operator, was hit by ransomware that limited the use of some of its systems in May.

Photo: Wiegels/Wikimedia Commons