Death by Ransomware

The keynote opens with a question about how to measure the human cost of ransomware. Emergency physician and security researcher Christian Demers, known in the hacker community as quaddi, frames the problem through cardiac arrest care, where minutes decide whether a patient's brain survives. He explains how deeply clinical work now depends on connected devices, electronic health records and shared third-party networks, so one breach can stall treatment far beyond the data it touches.

The middle of the talk turns to evidence. Hospital ransomware data is scarce because organizations limit disclosure and lose audit logs during an incident, so the research team looked at neighboring hospitals instead. In a San Diego case where five hospitals were hit by the Conti group, diversion hours spiked, ambulances queued at nearby emergency departments, and cardiac arrest patients were far less likely to survive with intact brain function during the outage. He also described the Change Healthcare breach and a CrowdStrike-related outage, showing how consolidation and shared platforms spread failures across regions. Thin budgets, legacy medical devices and a shortage of security staff make these risks harder to reduce.

The closing section presents a prototype that can stand up a 20-bed emergency department on a private cellular network in about half an hour, aimed at restoring essential clinical workflows when normal infrastructure cannot be trusted. He argues for a resuscitation-style model of cyber resilience and urges developers in any sector to recognize that their code may end up supporting patient care.