Healthcare Cyber Downtime Statistics: Outage Length, Diversions and Patient Harm Evidence

Most healthcare cyber statistics count stolen records, but the harm that matters to patients is operational: days without electronic records, ambulances sent elsewhere, cancelled procedures and slower care at the hospital next door. This page collects the downtime and patient impact figures we could trace to their publishers: peer reviewed research in JAMA Network Open, the University of Minnesota study of Medicare patients, NHS England's published updates on the 2024 Synnovis pathology attack, the American Hospital Association (AHA) survey on Change Healthcare, Comparitech's tracker of US healthcare ransomware attacks, the Sophos State of Ransomware in Healthcare 2025 and the Proofpoint and Ponemon Institute 2025 study of cyber insecurity in healthcare. It deliberately leaves out record counts and breach costs, which the Healthcare Data Breach Statistics Guide covers. It is written for healthcare CISOs, emergency planners, clinical safety officers and business continuity leads who need defensible numbers for downtime planning and board papers. Last reviewed: November 2026.

Key takeaways

• Outages last weeks, not hours. Comparitech's tracker of 654 confirmed ransomware attacks on US healthcare providers from 2018 to 2024 puts average downtime at over 17 days per attack, with a yearly average of 27.03 days in 2022.
• The blast radius reaches neighbouring hospitals. In the JAMA Network Open study of a May 2021 attack, an unaffected adjacent emergency department saw ambulance arrivals rise 35.2%, patients leaving without being seen rise 127.8% and stroke code activations rise from 59 to 103.
• Attacks are associated with higher in-hospital mortality. University of Minnesota researchers estimated that in-hospital deaths among Medicare patients rose from roughly 3 in 100 to about 4 in 100 during attacks, and attributed between 42 and 67 Medicare deaths to ransomware from 2016 to 2021.
• Supplier attacks stop clinical work at scale. NHS England reported 10,152 acute outpatient appointments and 1,710 elective procedures postponed at two London trusts in the 16 weeks after the June 2024 Synnovis pathology attack.
• Recovery is getting faster, but encryption still hurts. Sophos found 58% of healthcare ransomware victims fully recovered within a week in its 2025 survey (21% in 2024), yet only 9% of organisations whose data was encrypted recovered within a day.

Headline statistics

Statistics by theme

How long healthcare systems stay down

Comparitech compiles confirmed ransomware attacks on US medical facilities that offer patient services, using news reports, breach notices, company statements and state reporting tools. Downtime is the period during which systems were reported as unavailable. Its yearly averages show no sustained improvement through 2024.

Source for every row: Comparitech, US healthcare ransomware attacks, last updated 18 December 2024. The 2024 row was incomplete when published, and Comparitech listed a further 147 attacks it could not confirm. Its per-day cost figure (about $1.9 million on average) was derived from financial statements of 15 organisations and then applied to attacks without data, so treat the dollar totals as a rough order of magnitude, not a measured value.

Survey data from Sophos points to faster recovery in 2025. In the State of Ransomware in Healthcare 2025 (292 healthcare respondents in 17 countries, organisations of 100 to 5,000 employees, surveyed January to March 2025), 58% of victims had fully recovered within a week, up from 21% in the 2024 edition, and the share taking one to six months fell from 36% to 12%. The same report found data was encrypted in 34% of healthcare attacks, down from 74% in 2024, and where data was encrypted only 9% recovered within a day, compared with 35% where encryption was stopped. Sophos samples mid-sized organisations and asks respondents to self-report, so its recovery figures will look better than the tracker figures for large hospital systems.

Ambulance diversion and the effect on neighbouring hospitals

The most detailed public measurement of spillover is "Ransomware Attack Associated With Disruptions at Adjacent Emergency Departments in the US" (Dameff, Tully, Chan and colleagues, JAMA Network Open 2023;6(5):e2312270). It compared an unaffected San Diego emergency department across three four-week phases around a ransomware attack that hit another health system on 1 May 2021.

Source for every row: Dameff et al., JAMA Network Open, published 8 May 2023. The paper's abstract gives 102 stroke code activations during the attack phase and its results table gives 103; we use the table. Census and left-without-being-seen counts stayed above baseline in the four weeks after the attack, while ambulance arrivals and stroke volumes returned to normal. The study found no significant change in door-to-CT or acute stroke treatment times, which suggests the receiving hospital protected its time-critical pathways at the cost of longer waits for everyone else.

The AHA described this effect as a regional "ransomware blast radius". The practical lesson is that diversion plans need agreements with neighbouring hospitals and ambulance services, because a hospital that is not attacked still absorbs the surge.

Patient safety and mortality

The two kinds of evidence are not equivalent. The Minnesota estimate is based on claims data and a comparison of the same hospitals before and during attacks, and it found more severe attacks (those forcing diversion and cancellations) did more harm. The Proofpoint and Ponemon numbers are what IT and security staff believe happened, which is useful for showing perceived risk but should not be quoted as a measured death rate. The study was a working paper when reported, so check for a published version before citing exact effect sizes.

Supplier and clearinghouse outages

Two 2024 attacks showed that the system that fails need not be inside the hospital.

NHS England labels its Synnovis figures as unvalidated management information. During the incident NHS Blood and Transplant also asked O positive and O negative donors to book appointments, because hospitals could not cross-match blood at normal speed. The Change Healthcare Breach 2024 page covers how the clearinghouse attack began.

What the numbers mean for defenders

• Plan for at least three weeks of degraded operation: with average downtime above 17 days and a 2022 average of 27 days, downtime procedures written for a few hours of EHR outage are not enough. Paper workflows, staffing and supply ordering need to work for weeks. See the Clinical Downtime and EHR Downtime Procedures Guide.
• Treat diversion as a regional decision: the JAMA data shows a 35% ambulance surge at a neighbour. Agree diversion triggers, surge capacity and communications with nearby hospitals and ambulance services before an incident.
• Rank recovery by clinical dependency: pathology, imaging, pharmacy and the EHR drove the Synnovis and Minnesota impacts. Recovery time objectives should follow clinical risk, not IT tiering.
• Keep encryption from happening: Sophos found 35% of organisations recovered within a day when encryption was stopped and 9% when it was not. Immutable, isolated backups and fast containment are the biggest levers. See the Backup Security and Immutable Backup Guide.
• Map single points of failure in suppliers: a pathology provider and a claims clearinghouse caused two of the largest operational disruptions of 2024. Include critical suppliers in continuity tests and contracts.
• Protect the identities that run recovery: restoring directory services and privileged accounts is usually on the critical path. See Recovering IAM and PAM After Ransomware or Domain Compromise.

Measuring your own downtime readiness

Public statistics only help if you can compare yourself with them. These measures turn the figures above into internal KPIs.

Common failure patterns when using downtime statistics

• Mixing perception surveys with measured outcomes: "29% reported increased mortality" is a survey response, not a mortality rate. Pair it with the claims-based Minnesota estimate and say which is which.
• Quoting dollar downtime costs as facts: Comparitech's $1.9 million per day is an average from 15 organisations applied to hundreds of attacks. Use it to show scale, not to build a business case line item.
• Using one hospital's spillover as a national rate: the JAMA findings come from one region and one attack. They show the mechanism and its size in that case, not an expected value for every attack.
• Ignoring the survey population: Sophos covers organisations of 100 to 5,000 employees across 17 countries; Comparitech covers US providers only. Do not merge them into one recovery figure.
• Forgetting revisions: NHS England updated Synnovis figures weekly, and the 2024 Comparitech row was partial. Always give the as-of date.
• Counting only the attacked organisation: the evidence on neighbouring hospitals and on supplier outages shows the operational impact falls on organisations that were never breached.

Methodology notes and caveats

Comparitech counts attacks that were publicly confirmed and reports downtime from public statements, which favours large or well-reported incidents. Sophos is an annual vendor-commissioned survey of IT and security leaders, self-reported and limited to mid-sized organisations. Proofpoint and Ponemon survey US IT and security practitioners, who may not see clinical outcome data directly. The JAMA study is peer reviewed but single site, and the paper's own abstract and table differ by one on stroke activations. The Minnesota study used Medicare claims, so it covers older patients and was a working paper when the findings were reported. NHS England figures are unvalidated management information. None of these sources gives a reliable global figure for ambulance diversions, so this page does not offer one.

Framework mapping

Practitioner checklist

• Quote every downtime figure with its publisher, report name and as-of date.
• Separate measured outcomes (JAMA, Medicare claims, NHS data) from survey perceptions in board papers.
• Size downtime procedures for weeks of operation, using the 17 day average as a minimum planning case.
• Agree diversion triggers and surge support with neighbouring hospitals and ambulance services.
• Rank recovery objectives by clinical dependency: EHR, pathology, imaging, pharmacy.
• Run a timed full restore of the EHR from isolated backups at least once a year.
• Include critical suppliers such as pathology and claims processors in continuity exercises.
• Track the six readiness metrics above and report them alongside breach metrics.

Standards and references

• JAMA Network Open: Ransomware Attack Associated With Disruptions at Adjacent Emergency Departments in the US (Dameff et al.)
• NHS England: Update on cyber incident clinical impact in south east London, 26 September 2024
• NHS England: Update on cyber incident clinical impact in south east London, 4 July 2024
• American Hospital Association: Survey on the Change Healthcare cyberattack
• STAT: Ransomware attacks on hospitals and patient deaths (University of Minnesota study)
• Comparitech: Ransomware attacks on US healthcare organisations
• Sophos: The State of Ransomware in Healthcare 2025
• Proofpoint: Cyber Insecurity in Healthcare 2025

Related NHI Mgmt Group resources: Healthcare Data Breach Statistics Guide · Clinical Downtime and EHR Downtime Procedures Guide · Healthcare Incident Response Guide · Ransomware Statistics Guide · Threat Actors Targeting Healthcare Guide