Cyberattack impact on emergency department activity: an interrupted time series study in Barcelona

Background

Healthcare systems increasingly rely on digital infrastructure, exposing them to cyberattacks. The impact on emergency department (ED) activity and hospital resilience remains poorly documented. This study assessed the immediate, short-term and medium-term effects of a major ransomware attack on ED visits in a high complexity reference hospital in Barcelona, Spain, in March 2023.

Methods

An interrupted time series analysis was conducted using weekly ED visit data before and after a hospital-wide ransomware attack that caused total Information Technology (IT) shutdown. Visits were stratified by triage level to examine differential effects on high- and low-acuity cases. Baseline data from parallel periods in previous years were used. Segmented regression models estimated changes in level and trend and constructed a counterfactual scenario based on pre-intervention data

Results

ED visits decreased by approximately 17% inmediately after the attack, with larger relative reductions in lower-acuity cases. High-acuity visits also decreased, though the reduction was moderate compared to lower-acuity groups. No significant changes in post-attack trends were observed, indicating rapid recovery to baseline activity. The cyberattack disrupted access to electronic systems and shared health records, preventing several protocolized digital procedures and resulting in the implementation of manual workflows for patient admission, triage, census management, documentation, imaging requests, and laboratory result retrieval.

Conclusions

Major cyberattacks can cause abrupt but short-lived disruption in ED activity, disproportionately affecting lower-acuity visits. Effective contingency planning, manual workflows and phased IT recovery are critical to maintaining patient safety and operational continuity. Regular simulation exercises and preparedness strategies are recommended to strengthen hospital digital health resilience.

Key messages

• A ransomware cyberattack caused a 17% immediate reduction in ED visits, with a greater impact on lower-acuity cases, revealing differential vulnerability across patient groups.

• Despite severe digital disruption, ED activity rapidly returned to pre-attack trends, indicating that emergency care systems can maintain continuity through effective contingency measures.