When "It’ll Never Happen to Us" Kills: The Real-World Death Toll of Lax Digital Security

We still talk about digital security like it's about protecting bank balances and embarrassing emails. It isn't. It's about protecting heart monitors, water supplies, and cars doing 70 on the highway — and the bill for casual security is now being paid in lives.

In September 2020, a 78-year-old woman suffering an aortic emergency was turned away from a hospital in Düsseldorf, Germany. Ransomware had locked up the hospital's systems — no admissions, no records, no treatment. Her ambulance was diverted to a hospital roughly 30 kilometres away. She died en route or shortly after arrival. German prosecutors opened a negligent homicide investigation — the first time a death was formally examined as a possible consequence of a cyberattack. (Later inquiries questioned how directly the delay caused her death; prosecutors never indicted. But nobody disputes what the attack did to emergency care that night.)

This is the story we have failed to internalise: digital security is no longer a property of computers. It is a property of physical safety. Software now holds physical authority — over medication dosages, car steering, water chemistry, industrial safety valves. When security around that software is lax, the failure modes don't stop at data loss. They continue, uninterrupted, into the human body.

Here is what that looks like in practice. Every case below is real.

1. Hospitals: where downtime is measured in casualties

Springhill Medical Centre, Mobile, Alabama — 2019. For eight days in July, a ransomware attack crippled the hospital's electronic health records and, crucially, its fetal monitoring systems during active labours. Newborn Nicko Silar died days after delivery. Her mother, Teiranni Kidd, sued, alleging that with monitors dark and records inaccessible, clinicians missed signs of fetal distress that would have triggered an emergency C-section. The hospital settled the wrongful-death suit in 2023. One unpatched network, one dead infant — and the failure chain ran straight through the "IT stuff" nobody wanted to fund.

CommonSpirit Health / MercyOne, Iowa — 2022. Ransomware hit the second-largest nonprofit hospital chain in the United States. At MercyOne in Des Moines, a three-year-old received a dangerous overdose of painkillers because staff, working blind without electronic records, could not see what the child had already been given. At least 623,774 patients' records were ultimately exposed.

The pattern, quantified. In 2023, health economists studying ransomware attacks on US hospitals and matching them to Medicare claims found the obvious thing nobody had proven: ransomware attacks increase in-hospital mortality. For patients already admitted when an attack began, in-hospital death rates rose by roughly a third. The authors' dry conclusion is worth quoting: "To many, this will seem like proof of the obvious, but as health economists, we believe that data speak louder than anecdotes."

WannaCry vs. the NHS — 2017. A single worm, built on an exploit stolen from the NSA, tore through unpatched Windows machines in more than 150 countries. In the UK's National Health Service: roughly 19,000 appointments cancelled, five emergency departments diverting ambulances, MRI and CT scanners dark, and an estimated £92 million in damage. Microsoft had shipped the patch two months earlier. The NHS wasn't hacked by genius. It was killed by unpatched machines and flat networks — laziness, in other words, weaponised.

2. The road: two researchers, one Jeep, no contact

In July 2015, security researchers Charlie Miller and Chris Valasek remotely seized control of a Jeep Cherokee while a journalist drove it on a St. Louis highway — killing the engine in live traffic, from a laptop miles away. The entry point was the car's internet-connected entertainment system, which sat on the same network as steering-adjacent controls. Fiat Chrysler recalled 1.4 million vehicles — the first-ever recall for a cybersecurity defect. Nobody died, because the researchers told the world before someone nastier found the door. That door had been standing open in every Uconnect-equipped car on the road.

3. Water, power, and the machines that keep us alive

Oldsmar, Florida — February 2021. An attacker walked into the remote-access session of a water treatment plant and changed the sodium hydroxide (lye) level from about 100 parts per million to 11,100 — a hundredfold spike in a chemical that burns tissue. An alert operator watched the cursor move in real time and immediately reversed it. The only thing between a town's drinking water and mass poisoning was one person paying attention. Investigators later found the plant had been reached through a watering-hole attack — and, by most accounts, remote-access software sitting on the control network without modern protections.

Ukraine — December 2015. Russian Sandworm attackers used spear-phished credentials to open the breakers of regional power companies, leaving roughly 230,000 people without heat and light in the middle of winter, some for hours, some for more. This was not espionage. It was a demonstration that a spreadsheet, a stolen password, and a mouse cursor can reach into a city's physical infrastructure.

TRITON / TRISIS — Saudi Arabia, 2017. The most chilling case on this list. Malware found at a petrochemical plant was designed to attack the plant's Safety Instrumented System — the Schneider Triconex controllers whose entire job is to detect a disaster in progress and shut the plant down safely. TRITON's authors didn't want to steal data or extort money. They wanted to disable the last line of defence, so that the next physical failure would go all the way. A flaw in their code accidentally tripped the safety system into a shutdown instead. Think about what that sentence implies: someone built malware to convert a chemical plant into a bomb, and the only reason we know about it is a programming mistake — by the attackers.

4. The body as an attack surface

The FDA has issued safety communications on implantable cardiac devices — in 2018, Medtronic programmers were found to carry cybersecurity vulnerabilities serious enough for an official safety alert, and in 2019 unauthenticated wireless communication flaws were disclosed in a range of implantable devices. No death has been publicly attributed to a hacked pacemaker. But the design lesson is old and brutal: a device that keeps you alive should not accept unauthenticated commands.

We've known this since the 1980s. The Therac-25 radiation therapy machine delivered six massive radiation overdoses between 1985 and 1987, killing several patients. The cause wasn't malware — it was software bugs, hardware safety interlocks deliberately removed because "the software handles it," and engineers who refused to believe their code could kill anyone. Lax digital discipline — in testing, in patching, in doubt — has been lethal for forty years. Only the volume of digital systems now holding physical authority has changed.

5. The home front: when lax security is personal

You don't need nation-state malware to die of bad digital hygiene. Stalkerware — monitoring apps secretly installed on a partner's phone — surged during lockdown, helped along by a startling statistic: more than a quarter of mobile users run no lock-screen protection at all. An unlocked phone and an app store are all a controlling abuser needs. Location trackers make it worse: an Iowa man pleaded guilty in 2023 to stalking a woman with Apple AirTags he planted on her belongings, and wrongful-death litigation has alleged trackers played a role in murders. A phone that leaks your location, with a lock screen you never set, is not a privacy problem. For some people it is a survival problem.

Why does this keep happening?

Because we still treat security as an IT cost centre, while it has become a safety function. Schneier's security mindset says it plainly: everything is a computer now, every computer has an attack surface, and complexity is the enemy — more parts, more failure modes. WannaCry is his "perfect storm" in miniature: complexity (legacy Windows everywhere), connectivity (flat networks), and monoculture (one operating system across a national health service).

Because the human is the weakest link. Per Mitnick, the attack goes around the technology to the person — phishing that steals the credentials (Ukraine 2015), the watering-hole that compromises the operator's browser (Oldsmar), the urgency that forbids verification. And the human firewall works both ways: at Oldsmar, one attentive operator was the control that saved the town.

Because we hide behind obscurity instead of managing keys and patches. Kerckhoffs's principle, straight from Singh's The Code Book: security rests in the key — in today's terms, the credential, the patch level, the configuration — never in hoping nobody finds the flaw. WannaCry's exploit wasn't secret. It had been leaked. The patch existed. Both were known; the defence simply wasn't deployed. Hope is not a control.

What actually works

None of this requires genius or unlimited budgets:

Patch. The single highest-yield habit in security. WannaCry's patch was two months old before the outbreak. A routine patch cadence at the NHS would have saved £92 million and 19,000 appointments. Multi-factor authentication, everywhere. Stolen credentials powered the Ukraine grid attack. A second factor breaks that entire chain. Segment networks. A water plant's control systems, a hospital's monitors, a car's brakes — none of them should share a network with web browsers and email. Backups you have actually restored. Ransomware's leverage evaporates against a verified offline backup. Assume the human will be targeted, and train for it. Per Mitnick: urgency deserves a slower check; verify independently, never through the contact details the requester provides; no legitimate process ever needs your password. Protect people like they matter. Lock screens, app-permission audits, anti-stalkerware checks on devices in abusive households, and manufacturers who treat anti-tracking features as safety features.

The bottom line

A lock left off a phone, a patch left uninstalled, a remote-access port left open "temporarily," a safety interlock removed "because the software handles it" — each of these is a small, forgivable lapse. The Düsseldorf ambulance, the Springhill delivery room, the Oldsmar water supply, the TRITON safety system, the Therac-25 beam: these are what the lapses aggregate into.

Digital security is not paranoia, and it is not paperwork. It is maintenance on machines that can kill you. Treat it that way, and the death toll starts falling. Ignore it, and the next negligent-homicide investigation will have your organisation's name in the file — or worse, your name in the obituary.

The Seven Hinges

They raised the gate where the valley narrowed, so that the river could not come down upon the town all at once. It was stone and iron, older than anyone's grandfather. It held the water folded behind it, high above the chimneys, quiet as a held breath. The town grew up in its shadow and stopped seeing it.

A keeper lived beside the gate. His name was Osric. He had done the work since he was a boy, and the work never changed. Every morning, before the mist lifted, he walked the long curve of the gate with a lamp, a pot of grease, and a rag. He greased the seven great hinges. He tapped the seven iron pins with a little hammer. He listened.

Grease, tap, listen. An hour, every morning. None of it made a difference that anyone could see. The gate held on its own. The river lay patient on its own. A man might have missed the walk for a year, and the water would have gone on doing nothing at all.

Osric's hands stiffened. The mayor came to him in the spring.

"Hinges can wait," the mayor said. "The gate has stood a hundred years. It will stand a hundred more. Spend your hour on something a man can see."

Osric greased the hinges.

He died in the winter, and they gave the work to a strong young man named Corren, whose eyes were better than Osric's had ever been.

Corren walked the gate his first morning. He greased all seven hinges, tapped all seven pins, and found nothing wrong.

He walked it the second morning as well.

By the end of that first summer he greased the hinges that groaned, for those were plainly the ones in want of it. By the next spring he greased only the loudest, since it asked the most. By the third year he left the grease-pot at home on dry days. The river was low. The season was kind. There was a harvest to bring in, a girl in the lower town, and an hour is an hour.

"Not today," he said, passing the gate. "It will never come for us."

The town agreed with him. It was a sensible town. It had never once been flooded.

Below the gate, on the lower street, lived Nesta, who mended nets for the fishermen. She had mended them there for thirty years and knew every note the river made — the low brown mutter of it in summer, the thin ring it gave off ice, the deep clearing of its throat before weather. She worked with her hands and listened with the rest of her, as a miller listens to his stones.

That autumn the rain fell for four days without stopping. On the third night Nesta set down her needle and stood up, for the river had made a sound she had never heard it make in thirty years. It had stopped singing over the gate. It had begun to push beneath it.

She took a hand-bell and ran the lower street, waking doors. The town came up the hill in the dark, carrying what it could carry. The miller took his children. The baker took his mother on his back. The girl from the upper town, the one Corren loved, came out with wet hair and a lamp in her fist. She stood with the others on the high ground and looked down.

Corren woke to the bell. He ran for the gate with the grease-pot in his hand. The rain came flat at his face. He reached the gate and greased the hinges.

The stiff one turned at last. It turned too late. Dry these three years, its pin had sheared in the night. The leaf it held hung a hand's width open, and the water found the gap.

The lower street went under before the light came. Nesta's mending table floated out of her door, turned once, and went down the valley with the nets still on it.

At dawn Corren stood at the gate with the grease-pot in his hand. He greased the second hinge, and the third, and went on down the long curve, all seven, while the lower street lay flat and grey and quiet below him.

The End.