It was half past midnight Eastern Time when Andrew Rosenberg, an anesthesiologist and critical care doctor who works as chief information officer at Michigan Medicine, suddenly noticed that a substantial number of computers across the health care center had ceased to function. In the hospital’s parlance, it counted as a “catastrophic major incident.”
“We do some fairly sophisticated automatic monitoring of our core systems, and when those suddenly went offline, that triggered alerts,” says Rosenberg. “In a couple of our units, the majority of their computers all had the blue screen of death.”
It soon became clear that this was not an isolated incident. A cybersecurity company called CrowdStrike had made a routine update to its Falcon antivirus product, utilized by companies ranging from banks to airlines to hospitals. That update contained a bug, an error that caused all computers running the software on a Windows operating system to crash.
Around the globe, doctors, nurses, and hospital administrators were going into panic mode as they raced to manage the consequences of the largest IT outage in history. Mass General Brigham, one of America’s biggest health care systems, canceled all nonurgent surgeries, procedures, and medical visits. In the UK, Royal Surrey NHS Foundation Trust declared a critical incident affecting the systems used to deliver radiotherapy treatments. Hospitals in Canada, Germany, and Israel announced issues with their digital services, while the 911 emergency service in some US states was reported to be down. A WIRED reporter found both Baylor hospital network, one of the largest nonprofit health care systems in the country, and Quest Diagnostics unable to process routine bloodwork. Donna Rossi, a spokesperson at the Phoenix Police Department, explained that while calls were still going through, the lack of working internet meant that officers had to be dispatched manually.
The extent of the disruption appeared to vary both between and within health care systems. “Our hospital is fully down due to #Crowdstrike issue,” Dana Chandler, a nurse at GBMC HealthCare in Maryland, posted on X. “No phones, no computers, no safety nets. It’s an all-hands-on-deck kind of day. I hope our patients remain safe.” Rosenberg says that at Michigan Medicine, where he was awake since 1 am dealing with the crisis, anywhere from 15 to 60 percent of the computers were not working, depending on the unit.
“The impact is massive,” he says. “It affects all aspects of modern digital health systems. Luckily, in units where the computers are running the whole time, like the ICUs and emergency departments, the computers didn’t take the CrowdStrike application upgrade, whereas in areas of health care which are more episodic, like operating rooms, the disruption is much greater.”
Rosenberg says that the areas of greatest disruption have been so-called “digital bottlenecks,” which require communication between multiple computer systems. He gives the example of the critical practice of cleaning, disinfecting, and sterilizing medical devices and patient care supplies. This is monitored through digital tools across several computers, to ensure that best practices are followed and the risk of potentially lethal infections is minimized.