Ransomware (extortion): Hospital and care home, Germany 2020
From 10 September 2020, the hospital’s IT was largely paralysed by the DoppelPaymer ransomware, and the hospital withdrew from emergency care.
- Incident · 09.2020 · North Rhine-Westphalia (Düsseldorf), Germany
- Evidence: confirmed by an authority
- Ransomware (extortion)
As of
What happened
An emergency patient had to be taken to Wuppertal and died; the public prosecutor’s office initially investigated for negligent homicide, but later found no causal link. The ransom note was addressed to Heinrich Heine University; the hospital was probably a random victim.
- Affected
- Düsseldorf University Hospital
- Industry
- Hospital and care home
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Known Citrix vulnerability CVE-2019-19781 (patch available since January 2020)
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Anyone who installs security updates but does not check whether the system had already been compromised beforehand remains vulnerable.
Sources
- Patientin durch Folgen des Hacker-Angriffs gestorben (opens in a new window) Ärzte Zeitung · 2020-09
- Ransomware infection in University Hospital Düsseldorf not responsible for death of a woman (opens in a new window) Born's Tech and Windows World · 2020-11-18