After reading most of the comments, I am actually quite surprised at the overall "leniency" shown to the hosital's management. In particular, considering there

After reading most of the comments, I am actually quite surprised at the overall "leniency" shown to the hosital's management. In particular, considering there is absolutely no information on how the attack was actually carried out. One comment mentions that the German cybersecurity agency "confirmed" that initial access occurred through public-facing Citrix servers that were missing security patches, without any source to support the claim. Another commenter linked an article[1] indicating that the attack was "likely" carried out through Citrix servers, which seems more speculative than anything. I think that two elements are worth mentioning here. First, protecting an IT infrastructure from ransomware is not a "simple" IT task (e.g. patching a server or just doing regular backups) but requires the successful implementation and combination of a large set of technical and organizational measures/controls. Without additional details, in particular regarding how initial access[2] then lateral movement[3] were carried out by the attackers, I don't see any validity in debating whose fault this is. But that's just my opinion... Second, press coverage[4] seems quite adamant that the hospital was not targeted and that the attack was a collateral damage that resulted from the university and the hospital having their information system mutually trusting each other. If we had to consider collateral damage as a valid ground to sentence someone to life in prison (as suggested in several comments here), many governments that offer the highest level of freedom to their citizens should definitely start expanding their prisons. In many countries and regions, Europe in particular, collateral damage is not necessarily attributed to recklessness or negligence. In order to support the accusation made by many commenters here, we would need to demonstrate either of two of the following: 1. That the attackers knew in advance that compromising the university would also result in compromising the hospital. 2.That hospital/health critical information systems being directly linked to universities without adequate security is common practice AND common knowledge among cybercriminals. Except for the "five eyes" countries, the justice system in most civilized countries still recognizes the notion that an accused should not necessarily carry the total burden of the damage caused by her/his actions. In other words: although Germany may charge the author(s) for homicide by negligence, they will very likely also have a good look at whether or not the hospital's management did not commit recklessness, either by refusing care to a dying patient, or by failing to protect its critical information system or by failing to implement fallback procedures as any other critical infrastructure supposedly does today. Until then, I probably repeat myself, I don't see any validity in debating responsibilities in this specific incident, or expressing wishful thinking, until we have more information about what happened. 1: https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesseldorf-Shitrix-schlug-zu-4904979.html https://www.heise.de/news/Cyber-Angriff-auf-Uniklinik-Duesse... 2: https://attack.mitre.org/tactics/TA0001/ https://attack.mitre.org/tactics/TA0001/ 3: https://attack.mitre.org/tactics/TA0008/ https://attack.mitre.org/tactics/TA0008/ 4: https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94 https://apnews.com/cf8f8eee1adcec69bcc864f2c4308c94