At Least 750 US Hospitals Faced Disruptions During Last Year’s CrowdStrike Outage, Study Finds

When, one year ago today, a buggy update to software sold by the cybersecurity firm CrowdStrike took down millions of computers around the world and sent them into a death spiral of repeated reboots, the global cost of all those crashed machines was equivalent to one of the worst cyberattacks in history. Some of the various estimates of the total damage worldwide have stretched well into the billions of dollars.

Now a new study by a team of medical cybersecurity researchers has taken the first steps toward quantifying the cost of CrowdStrike's disaster not in dollars, but in potential harm to hospitals and their patients across the US. It reveals evidence that hundreds of those hospitals' services were disrupted during the outage, and raises concerns about potentially grave effects to patients’ health and well-being.

Researchers from the University of California San Diego today marked the one-year anniversary of CrowdStrike's catastrophe by releasing a paper in JAMA Network Open, a publication of the Journal of the American Medical Association Network, that attempts for the first time to create a rough estimate of the number of hospitals whose networks were affected by that IT meltdown on July 19, 2024, as well as which services on those networks appeared to have been disrupted.

By scanning internet-exposed parts of hospital networks before, during, and after the crisis, they detected that at minimum 759 hospitals in the US appear to have experienced network disruption of some kind on that day. They found that more than 200 of those hospitals seemed to have been hit specifically with outages that directly affected patients, from inaccessible health records and test scans to fetal monitoring systems that went offline. Of the 2,232 hospital networks they were able to scan, the researchers detected that fully 34 percent of them appear to have suffered from some type of disruption.

All of that indicates the CrowdStrike outage could have been a “significant public health issue,” argues Christian Dameff, a UCSD emergency medicine doctor and cybersecurity researcher, and one of the paper's authors. “If we had had this paper's data a year ago when this happened," he adds, “I think we would have been much more concerned about how much impact it really had on US health care.”

CrowdStrike, in a statement to WIRED, strongly criticized the UCSD study and JAMA’s decision to publish it, calling the paper “junk science.” They note that the researchers didn’t verify that the disrupted networks ran Windows or CrowdStrike software, and point out that Microsoft’s cloud service Azure experienced a major outage on the same day, which may have been responsible for some of the hospital network disruptions. “Drawing conclusions about downtime and patient impact without verifying the findings with any of the hospitals mentioned is completely irresponsible and scientifically indefensible,” the statement reads.

“While we reject the methodology and conclusions of this report, we recognize the impact the incident had a year ago,” the statement adds. “As we’ve said from the start, we sincerely apologize to our customers and those affected and continue to focus on strengthening the resilience of our platform and the industry.”

In response to CrowdStrike’s criticisms, the UCSD researchers say they stand by their findings. The Azure outage that CrowdStrike noted, they point out, began the previous night and affected mostly the central US, while the outages they measured began at roughly midnight US east coast time on July 19—about the time when CrowdStrike’s faulty update began crashing computers—and affected the entire country. (Microsoft did not immediately respond to a request for comment.) “We are unaware of any other hypothesis that would explain such simultaneous geographically-distributed service outages inside hospital networks such as we see here” other than CrowdStrike’s crash, writes UCSD computer science professor Stefan Savage, one of the paper’s co-authors, in an email to WIRED. (JAMA declined to comment in response to CrowdStrike’s criticisms.)

In fact, the researchers describe their count of detected hospital disruptions as only a minimum estimate, not a measure of the real blast radius of CrowdStrike's crashes. That's in part because the researchers were only able to scan roughly a third of America's 6,000-plus hospitals, which would suggest that the true number of medical facilities affected may have been several times higher.

The UCSD researchers' findings stemmed from a larger internet-scanning project they call Ransomwhere?, funded by the Advance Research Projects Agency for Health and launched in early 2024 with the intention of detecting hospitals' ransomware outages. As a result of that project, they were already probing US hospitals using the scanning tools ZMap and Censys when CrowdStrike's July 2024 calamity struck.

For the 759 hospitals in which the researchers detected that a service was knocked offline on July 19, their scans also allowed them to analyze which specific services appeared to be down, using publicly available tools like Censys and the Lantern Project to identify different medical services, as well as manually checking some web-based services they could visit. They found that 202 hospitals experienced outages of services directly related to patients. Those services included staff portals used to view patient health records, fetal monitoring systems, tools for remote monitoring of patient care, secure document transfer systems that allow patients to be transferred to another hospital, “pre-hospital” information systems like the tools that can share initial test results from an ambulance to an emergency room for patients requiring time-critical treatments, and the image storage and retrieval systems that are used to make scan results available to doctors and patients.

“If a patient was having a stroke and the radiologist needed to look at a scan image quickly, it would be much harder to get it from the CT scanner to the radiologist to read,” Dameff offers as one hypothetical example.

The researchers also found that 212 hospitals had outages of “operationally relevant” systems like staff scheduling platforms, bill payment systems, and tools for managing patient wait times. In another category of “research relevant” services, the study found that 62 hospitals faced outages. The biggest fraction of outages in the researchers' findings was an “other” category that included offline services that the researchers couldn't fully identify in their scans at 287 hospitals, suggesting that some of those, too, might have been uncounted patient-relevant services.

“Nothing in this paper says that someone's stroke got misdiagnosed or there was a delay in the care of someone getting life-saving antibiotics, for instance. But there might have been,” says Dameff. “I think there's a lot of evidence of these types of disruptions. It would be hard to argue that people weren't impacted at a potentially pretty significant level.”

The study’s findings give a sprawling new sense of scope to anecdotal reports of how CrowdStrike’s outage affected medical facilities that already surfaced over the last year. WIRED reported at the time that Baylor hospital network, a major nonprofit health care system, and Quest Diagnostics were both unable to process routine bloodwork. The Boston-area hospital system Mass General Brigham reportedly had to bring 45,000 of its PCs back online, each of which required a manual fix that took 15 to 20 minutes.

In their study, researchers also tried to roughly measure the length of downtime of the hospital services affected by the CrowdStrike outage, and found that most recovered relatively quickly: About 58 percent of the hospital services were back online within six hours, and only 8 percent or so took more than 48 hours to recover.

That's a far shorter disruption than the outages from actual cyberattacks that have hit hospitals, the researchers note: Mass-spreading malware attacks like NotPetya and WannaCry in 2017 as well as the Change Healthcare ransomware attack that struck the payment provider subsidiary of United Healthcare in early 2024 all shut down scores of hospitals across the US—or in the case of WannaCry, the United Kingdom—for days or weeks in some cases. But the effects of the CrowdStrike debacle nonetheless deserve to be compared to those intentionally inflicted digital disasters for hospitals, the researchers argue.

“The duration of the downtimes is different, but the breadth, the number of hospitals affected across the entire country, the scale, the potential intensity of the disruption is similar,” says Jeffrey Tully, a pediatrician, anesthesiologist, and cybersecurity researcher who coauthored the study.

A delay of hours, or even minutes, can increase mortality rates for heart attack and stroke patients, says Josh Corman, a cybersecurity researcher with a focus on medical cybersecurity at the Institute for Security and Technology and former CISA staffer who reviewed the UCSD study. That means that even a shorter-duration outage in patient related services across hundreds of hospitals could have concrete and seriously harmful—if hard to measure—consequences.

Aside from drawing a first estimate of the possible toll on patients' health in this single incident, the UCSD team emphasizes that the real work of their study is to show that, with the right tools, it's possible to monitor and learn from these mass medical network outages. The result may be a better sense of how to prevent—or in the case of more intentional downtime from cyberattacks and ransomware—protect hospitals from experiencing them in the future.