Explainer on academic research: no specific actorhigh
Those already admitted when the attackers came in: what a study on hospital ransomware measures
That hospital ransomware is serious, everyone says. Quantifying it is another matter, because it requires separating the attack's effect from everything else. A study published in 2026 in the American Economic Journal: Economic Policy — Neprash, McGlave and Nikpay — linked a database of hospital ransomware attacks to Medicare administrative claims, and measured two things. First: hospital volume falls 17-24% in the attack week, recovering in about three weeks. Second, the one that changes the conversation: among patients already admitted when the attack begins, in-hospital mortality rises 34-38%. Not a risk estimate: a measurement on real patients.
The trouble with measuring the obvious
Anyone who works in a hospital knows what happens when the systems stop: back to paper, slow down, defer whatever can be deferred. The hard leap is different: showing that the slowdown translates into worse clinical outcomes, and by how much.
It is hard for a methodological reason. Hospitals that get attacked are not a random sample, patients arriving during an attack are not like those of an ordinary week, and a hospital in crisis tends to turn away complex cases, which get diverted elsewhere. Compare mortality before and after and you end up measuring the triage rather than the attack.
The study Hacked to Pieces? — Hannah Neprash, Claire McGlave and Sayeh Nikpay, published in 2026 in the American Economic Journal: Economic Policy (volume 18, issue 1, pages 256-281) — works around the problem by building a database of hospital ransomware attacks and linking it to Medicare administrative data, the US federal health programme for people over 65.
The two numbers
The first is about the hospital. In the attack week, volume falls 17-24%. Recovery takes about three weeks. It is a measure of how much a hospital shrinks when it loses its systems: fewer admissions, fewer procedures, fewer patients taken on.
The second is about the patients. Among those already admitted when the attack begins, in-hospital mortality rises 34-38%.
Looking at those already inside is the clever part of the work, and it is what makes the number defensible. Those patients were admitted before the attack: their composition was not altered by the defensive triage of the following days. They were not diverted, not selected. They were there, and then the hospital around them stopped working as it had.
How to read a 34-38% rise
One caution is needed, and it belongs before any public use of the figure. This is a relative increase, not an absolute one. Where baseline mortality in a given ward is low, a 34% rise remains a small number in absolute terms; where it is high, it becomes large. A relative increase does not tell you how many people: it tells you how much worse the probability gets for someone in that condition.
Limits of transferability should also be declared. The study is built on US hospitals and Medicare data, so on an elderly population and a health system with its own characteristics. There is, as far as we know, no equivalent study on Italy's national health service: applying these percentages directly to an Italian hospital would be a leap the data do not license. The mechanism, though — systems down, records unavailable, diagnostics slowed, therapies administered on paper — has no obvious reason to differ.
Why this changes the conversation about the ransom
Public debate on ransomware has revolved for years around one question: pay or do not pay. It is a question that treats the attack as an economic problem, where the quantities are euros, downtime days and recovery costs.
When the victim is a hospital, that accounting is incomplete by construction. The outage does not only produce a cost: it produces an outcome. And the outcome, according to this study, falls particularly on the people who cannot leave — those already admitted, those mid-course in treatment, those with no option to go elsewhere.
No automatic answer about ransoms follows. What does follow is that, for a healthcare organisation, continuity plans are not an administrative line item: they are a clinical safeguard. The right question is not "how fast do we get back online", it is "what keeps working while we are offline, and for whom".
- 01Attackclinical and administrative systems stop
- 02Shrinkageactivity volume falls 17-24%, new cases are diverted
- 03Who remainsthose already admitted are not diverted, and the mortality rise concentrates there
What a healthcare organisation does with this
Written degradation procedures, not improvised ones. What you do without an electronic health record, without the lab system, without medication management. Whoever writes them while the systems work writes them better than whoever writes them at three in the morning.
Rehearse the return to paper, not only the restore. The typical exercise tests backup restoration. What this study suggests is different: rehearse the weeks in between, when the systems are not back yet and the patients are.
Count the patients already inside. In continuity planning, the most exposed population is not the one that will arrive: it is the one already there. It is also the only one that cannot be diverted.
A note on what this article is not. It is not the account of an attack: it is a reading of a peer-reviewed study measuring aggregate effects on a population. The two figures reported — volume decline and mortality rise — are those published by the authors. Anyone wanting to check methodology, confidence intervals and specifications will find the full text in the references below, and that is the route we recommend before quoting the figure elsewhere.
