Ransomware may have serious consequences, but among the latest attacks might have been fatal. BBC News reports (via MIT Technology Review) that prosecutors in Cologne, Germany have launched a negligent homicide investigation following a Düsseldorf University Hospital patient died carrying out a ransomware incident. On September 9th the attack hampered emergency services, forcing healthcare workers to send the individual to a hospital 19 miles away for vital treatment.
Local media claim the hackers were targeting another university and didn’t mean to compromise a healthcare facility. They reportedly provided the ransomware decryption key free of charge after they realized their mistake.
Whatever the intentions, this might have already been an avoidable breach. The intruders exploited a known security flaw in Citrix’s VPN software, and Germany’s cybersecurity authority said it warned of the vulnerability in January. It’s nothing new for institutions to flunk on security, but this misstep has been deadly.
If the investigation establishes a link, it may be among the first deaths associated with a cyberattack directly, in accordance with former UK security executive Ciaran Martin. If that’s the case, losing may spur hospitals along with other critical facilities to tighten security and stop future tragedies.