When ransomware locks up a hospital’s computers, patients pay with their lives. Among people already admitted when an attack begins, in-hospital mortality rises by 34 to 38%, according to a study of Medicare patients at attacked US hospitals.
The paper, “Hacked to Pieces? The Effects of Ransomware Attacks on Hospitals and Patients,” is by Hannah Neprash, Claire McGlave and Sayeh Nikpay of the University of Minnesota. It appears in the February 2026 issue of American Economic Journal: Economic Policy, in its February 2026 issue.
Building a database of attacks
Ransomware is malicious software that blocks access to electronic systems until a ransom is paid. In hospitals that can mean no access to health records, scans or patient histories, cancelled surgeries and ambulances sent elsewhere.
The authors built their own database of ransomware attacks on health care providers between 2016 and 2021, combining data from a threat intelligence firm with federal breach reports and news coverage of disruptions. It counted 374 attacks, 74 of which hit a total of 160 US hospitals.
They linked that list to fee-for-service Medicare claims and compared attacked hospitals before and during attacks with hospitals that were not attacked, exploiting the staggered timing of the attacks.
Fewer patients, more deaths
In the first week of an attack, hospital volume falls by 17 to 24%, according to the published paper. Patients return quickly, with recovery within three weeks.
The striking result concerns people who were already in a hospital bed when systems went down. Their in-hospital mortality rose by 34 to 38% compared with similar patients admitted and discharged in the weeks before.
An earlier version of the paper found larger mortality effects at hospitals with especially severe attacks, those leading to cancelled surgeries or ambulance diversion. The oldest and sickest patients, patients in intensive care and patients of color were also hit harder.
A problem for the whole market
The earlier version also found that nearby hospitals absorbed emergency patients turned away from attacked facilities, so total patient volume in the local market did not change. Patients at those neighbouring hospitals showed no rise in mortality.
That spillover is why the authors argue ransomware should be treated as a market-wide event. Only 4% of US hospitals were attacked between 2016 and 2021, yet 1 in 4 hospital markets felt the effects.
The researchers note that hospitals spend 6% or less of their IT budgets on cybersecurity, according to one survey they cite. At the time of the earlier draft, federal health officials were planning minimum cybersecurity standards for hospitals starting in 2029.
Study Details:
- Title: Hacked to Pieces? The Effects of Ransomware Attacks on Hospitals and Patients
- Authors: Hannah Neprash, Claire McGlave, Sayeh Nikpay
- Journal: American Economic Journal: Economic Policy, Vol. 18, No. 1, pp. 256-281
- Publication Date: February 2026
- DOI: 10.1257/pol.20240594