JMIR Publications

ABSTRACT

Background:

Cyberattacks against healthcare organisations are rising in frequency, while in parallel the nature of these attacks are shifting from data theft to intentional ‘denial of care’. Despite the growing reports of patient harms emerging from healthcare cyberattacks, there is limited translational research that connects upstream digital failures to downstream clinical consequences for patients.

Objective:

Our study systematically identifies and characterises patient-level harms occurring during hospital cyberattacks across international settings, determines which clinical populations are most vulnerable, and compares findings from academic literature with patient and provider narratives on social media to assess whether traditional mechanisms adequately capture the full landscape of patient safety incidents.

Methods:

We conducted a systematic review following PRISMA guidelines across PubMed, Scopus, and Web of Science for peer-reviewed studies published between 1st January 2004 and 1st July 2025. For the same time period, we developed a Python algorithm mining 3,408 healthcare subreddits (identified through medical terminology - CDC condition databases) for cyberattack terms extracted during the academic review (e.g. Conti Ransomware). Clinical team members reviewed academic studies and social media posts for cyberattack-induced patient level harms, assigned each to the most relevant clinical specialty (e.g. pediatrics) and technical domain (e.g. imaging systems).

Results:

We present the first transnational cross-disciplinary analysis of cyberattack-induced patient harms identified from global case studies (n=316). Our findings reinforce existing research, identifying risks for time critical conditions e.g. stroke, and reveals neglected risks affecting wider vulnerable groups (chronic pain patients, women in labour). While academic studies frequently focused on in-patient effects, our data exposed clinical risks in outpatient settings, including barriers for end-of-life patients receiving comfort care, issues for women accessing reproductive health services, and psychiatric patients experiencing deterioration in symptoms. Through a technical lens, we see specific issues related to (i) hardware (oncological harms due to compromised linear accelerators), (ii) software (risks for fracture patients due to failures in digital templating software) and (iii) networks/connectivity (foetal deaths due to telemetry failures). Social media data exposed wider harms manifesting due to infrastructural failures including compromised door access systems preventing life-saving treatment, failures in ward-based alarms and CCTV affecting staff/patient safety, and disrupted health-at-home services preventing community therapies.

Conclusions:

Our study provides the first systematic, transnational documentation of patient harms during healthcare cyberattacks. By integrating academic literature with social media narratives, we reveal risks beyond those captured in traditional research, including harms to outpatient populations, community care settings, and critical infrastructure systems. Our findings demonstrate the need for translational frameworks linking technological failures to clinical consequences. We release our datasets to enable clinicians, cybersecurity researchers, and policymakers to develop evidence-based preparedness strategies, improve cyber-risk models, and safeguard vulnerable patients during these increasingly common events. Clinical Trial: N/A