Skip to content
Homicide Inquiry Launched After Hospital Ransomware Attack in Germany

Homicide Inquiry Launched After Hospital Ransomware Attack in Germany

First seen 20 Oct 2026, 14:19 UTC •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 15:19 UTC
  • •A ransomware attack on Düsseldorf University Hospital resulted in a patient's death.
  • •The attack was reportedly a mistake, targeting the wrong organization.
  • •German police have launched a homicide investigation into the incident.

A ransomware attack on Düsseldorf University Hospital led to the death of a female patient who was diverted to another facility due to inoperable systems. The attack occurred on September 9, 2026, scrambling data and rendering the hospital's computer systems unusable. Prosecutors in Cologne have initiated a homicide investigation, suggesting that the hackers may be liable for the patient's death. The ransomware was reportedly aimed at Heinrich Heine University, not the hospital, indicating a botched attack. After the incident, police contacted the attackers and received a decryption key, but this came too late for the victim. The attack highlights the severe risks posed by ransomware to healthcare infrastructure. Investigations are ongoing to determine the full extent of the impact and whether the hospital's response protocols were adequate.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-09
Ransomware attack on Düsseldorf University Hospital
Hackers disabled computer systems, leading to a patient's death during transfer to another hospital.
BBC News
2026-10-17
Homicide inquiry launched
Cologne prosecutors opened a negligent homicide case linked to the ransomware attack.
BBC News
2026-10-20
Further reporting on attack details
Reports confirm the ransomware note was mistakenly addressed to Heinrich Heine University, not the hospital.
Graham Cluley

More articles in this cluster (2)

Following this threat?

Track Düsseldorf University Clinic in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What systems were affected by the ransomware?
Thirty servers at Düsseldorf University Hospital were infected, rendering critical systems inoperable.
What is the current status of the investigation?
A homicide inquiry is underway, focusing on the potential negligence of the hackers and hospital protocols.
Were any ransom payments made?
The attackers reportedly provided a decryption key without demanding payment after realizing they targeted the wrong organization.