Economic Impact of a Hospital Cyberattack in a National Health System: Descriptive Case Study (Preprint)

Abstract

BACKGROUND Following the recent cyberattack on a mid-level hospital in Portugal (around five years later first major cyberattack on an institution of the National Health Service on a scale this group of scientists was dedicated to estimating the economic impact of cyberattacks on the Portuguese health system. OBJECTIVE In the absence of public information on the cyberattacks that occurred, we aim, while using public domain data, to (i) identify the data breaches on the Portugues National Health System since 2017 and (ii) estimate and measure its economic impact using an attack simulation as a case study. METHODS Facing unavailable public domain data to sustain such information as a pressing constraint, we hypothesize such attack to support our estimates for our calculations. RESULTS As a result, we estimated a daily cost impact which highlights that, for an institution with HGO (served population of ca. 350,000 people), postponing 50% of external consultations (amounting to a yearly contract value of €22,700,338.00) may have a daily cost impact of 45,400.66 € to the institution. We further developed an open source Economic Impact Simulator on healthcare cyber-attacks. CONCLUSIONS Our study demonstrates the importance of adopting effective preventive and reactive strategies, such as contingency plans, as well as a superior investment in improving cybersecurity capabilities in this critical area.