A ransomware attack on Springhill Medical Center in the US state of Alabama could become the first officially registered case of a cyber intrusion leading to a fatality, after a malpractice suit was filed against the hospital.
The medical institution had its entire computer system, including health records, patient state monitors' live feed and other equipment down for a couple of days. Springhill decided not to pay the ransom and restore the system itself – which it did, but not until one of its doctors delivered the daughter of one of its pregnant patients - Teiranni Kidd.
The child suffocated due to an umbilical cord entanglement, and even though she had been resuscitated, the child suffered massive brain damage and died nine months later. Now Kidd is suing the hospital for failing to avert the disaster.
The said condition is normally resolved by performing a C-Section, but in Kidd's case, the delivering doctor was unaware that the foetus had an umbilical cord issue. While it's easily detectable on heart rate monitors, due to a foetal heart trying frantically to compensate for restricted blood flow with an increased heart rate, the nurses at Springhill Medical Center failed to detect it in time.
The bedside monitors were working at the hospital despite the attack, but they were no longer live-feeding the information to the nursing post, where nurses and doctors would routinely check the information for anomalies. Springhill tried to cover up for the loss of valuable functionality by various workarounds, but, for reasons unknown, the anomalies in the heart readings of Kidd's child remained unnoticed amid the paperwork chaos that the hospital was experiencing as a result of the ransomware attack.
Now, the court will be reviewing the incident to decide how much of the guilt lies with the hospital, which not only continued to operate after being hit by the malicious software but also failed to warn its patients, Teiranni Kidd included, about the problems it was experiencing at the time. It is also yet unclear how much blame can be attributed to the ransomware and those who carried out the attack for what happened to the woman's child.