Ransomware cripples Dutch hospitals, EHR systems down

Dutch hospitals have faced widespread disruption to electronic health record (EHR) services after a ransomware incident hit a major healthcare software provider. The incident occurred on April 7, and critical digital functions were disabled as a precaution in response. The provider supplies EHR systems to approximately 70% of hospitals in the Netherlands, making the impact broad across the country’s healthcare network.

The disruption has affected how hospitals manage patient records and how staff communicate through digital platforms tied to the provider’s services. Hospitals have reported logistical strain rather than a complete halt in care. Critical care processes have not stopped, but routine workflows have been forced to adapt quickly as systems were taken offline or limited.

In response, hospitals increased manual procedures and shifted to alternative communication methods. Some facilities temporarily disconnected the provider’s software from their networks to reduce exposure. These steps were taken while the scope of the compromise was being assessed and while hospitals sought to maintain continuity in patient care under constrained digital conditions.

A confidential memo advised customers to sever secure VPN connections after the provider’s systems were compromised. The provider said there may have been unauthorized access to its systems. It also stated it could not rule out the possibility that patient data was accessed or stolen, leaving uncertainty around the extent of any data exposure.

What it means: The incident has drawn attention to the operational fragility that can arise when a large share of a national hospital system relies on a single technology supplier for core clinical records and communications. With approximately 70% of Dutch hospitals using the same EHR provider, precautionary shutdowns can quickly translate into nationwide disruption, even when frontline critical care continues.

For global markets and policymakers, the episode underscores how cyber incidents can create immediate operational risk in essential services and raise questions about resilience in centralized healthcare IT infrastructure. It also highlights the data-security stakes tied to EHR platforms, where uncertainty about access or theft can trigger extensive internal controls and emergency workarounds across multiple institutions.

Key unknowns remain, including whether patient data was accessed or exfiltrated and how long full digital services will remain constrained. Hospitals and the provider continue to manage the balance between restoring functionality and limiting further risk, while maintaining care delivery through manual processes and alternative communications.