Ransomware spillover to adjacent San Diego emergency departments

Incident

Ransomware spillover to adjacent San Diego emergency departments

1 May 2021San Diego County, California, United StatesFell to tier 2: manual operationConnectivity & data Human handoff Cascades

A month-long ransomware attack on a health system with about 25% of regional inpatient discharges drove patients and ambulances to two unaffected academic EDs, raising their census, waits and stroke activations.

PathConnectivity & data → Human handoff

Sources checked when written 26 September 2026

TierThe study reports, citing local media, that the attacked system lost its electronic health records, imaging and telemedicine systems and reverted to paper records for about four weeks. The neighbouring EDs stayed at tier 0 under load. How tiers are assigned.

What happened

Dameff et al. (JAMA Network Open, 2023) compared two urban academic emergency departments that were not attacked, before, during and after a ransomware attack (1–28 May 2021) on a neighbouring health system with about 25% of San Diego County's inpatient discharges. During the attack phase the unaffected EDs saw a 15.1% rise in daily census, 35.2% more ambulance arrivals, a 127.8% rise in patients leaving without being seen, and a 47.6% rise in median waiting-room time. Confirmed strokes rose from 22 to 47, and county-wide EMS diversion hours also rose. The study is the clearest evidence that a cyberattack on one organisation becomes a capacity and time-critical-care problem for its neighbours.^[1,2]

Documented harm

Adverse outcomes at the attacked system are not documented in the source reviewed. At adjacent EDs, delays (longer waits and length of stay, more patients leaving without being seen) and higher stroke volumes were documented.

What it teaches

Neighbouring hospitals absorb the load of an attacked system without any warning.
Stroke and other time-critical pathways are where spillover shows first.
Regional plans need to treat one member's cyber outage as a regional surge event.
A multi-week tier 2 outage at one hospital raises the load on neighbouring hospitals, so exercise regionally.
Plan for weeks, not hours.
Time-critical pathways such as stroke need downtime versions at receiving hospitals too.

Sources

Ransomware Attack Associated With Disruptions at Adjacent Emergency Departments in the US. JAMA Network Open (Dameff C, Tully J, Chan TC, et al.), 8 May 2023. Primary Peer-reviewed · link checked 2026-09-26
Sentinel Event Alert Issue 67: Preserving patient safety after a cyberattack. The Joint Commission, 15 August 2023. Primary Guidance · link checked 2026-09-26

All incidents · Connectivity & data · Human handoff · Cascades

Information only, not advice. FailSystems is an aggregation and synthesis of published sources. It is not consulting, engineering, legal, regulatory or medical advice, and using it creates no professional relationship. Health systems are complex and no approach fits every organisation: anything you adopt is your own decision, at your own risk, and should be checked against the current official sources and by qualified people who know your setting. Full disclaimer.

Dealing with an incident right now? This site is a reference, not an incident-response service. Activate your organisation's emergency operations plan and incident command, and:

Life-threatening emergency: call 911.
Cyberattack or ransomware: report to CISA and the FBI field office near you (or IC3).
Power loss, disaster or resource needs: go through your local or county emergency management. They escalate to the state, and the state requests FEMA support; hospitals do not call FEMA directly.
A medical device problem: report it to the manufacturer and to FDA MedWatch.
Outside the US: your national emergency number and national cyber agency (in the UK, NCSC).

From Health 201FailSystems