It was a loose wire, not a hacker. That is the lesson.
At 1:29 in the morning on March 26, 2024, the container ship Dali lost electrical power in the Patapsco River, drifted without propulsion or steering, and struck a pier of the Francis Scott Key Bridge. The bridge fell into the water in seconds. Six road workers filling potholes on the span died. When we wrote about it a fortnight later, the official line was that there was no evidence of foul play, the internet was full of theories that there was, and the honest question for anyone in the security business was: how hard would it be?
The National Transportation Safety Board closed its investigation on December 10, 2025, after 20 months. There was no attack. The ship blacked out because of a loose signal wire at a terminal block, which came loose because a wire-label band had been installed badly. A second blackout followed because the crew had been feeding the generators with a flushing pump that was never designed to restore fuel pressure after an outage. A misplaced label and a wrong pump took down a bridge that is now expected to cost between $4.3 billion and $5.2 billion to replace, with reopening pushed to 2030.
That is a better cyber security lesson than a hack would have been.
Ships were warned, years earlier
In 2018 the security publication The Security Ledger ran a piece under the headline "Container ships easy to hack, track, send off course and even sink, security experts say." Ken Munro of Pen Test Partners described shipboard systems that were years behind ordinary office IT, and pointed at the thing that had changed: always-on satellite connections had put vessels on the internet without putting them behind any serious defence. Navigation, engine management and cargo systems that were designed for an isolated ship were suddenly reachable from anywhere.
Six years later a ship did lose control near a bridge, and the cause was not one of the dramatic scenarios in that article. It was maintenance. The systems that failed were ordinary, the failure was small, and nobody had looked at it because it was not the kind of thing anyone expected to matter.
What this has to do with a medical practice
Every breach we have seen a healthcare client go through has the same shape. Not a brilliant adversary defeating strong defences, but a small, ordinary weakness nobody had checked:
- A remote-access portal without multi-factor authentication. That was the way into Change Healthcare in February 2024, the largest healthcare breach on record.
- A server two months behind on patches. That was WannaCry in 2017.
- A password reused from a personal account that had already leaked.
- A former employee's login that was never switched off.
- A billing vendor whose own security nobody at the practice ever asked about.
Attackers go after healthcare because the data is valuable and the organisations cannot afford to be offline. A practice that cannot see its own records will pay to get them back, and a records breach has to be notified to every patient and to regulators whether or not a ransom was paid. The small part that fails is almost never the part the practice was worried about.
What to check this week
None of this needs a security consultant to start:
- Multi-factor authentication on every remote login, including the EHR, email and any vendor portal.
- A list of every account that can reach patient data, and a rule that leavers are removed the day they leave.
- Patching on a schedule, with the devices that cannot be patched kept off the main network.
- Backups that are offline and that someone has actually restored from.
- One question to every vendor that touches your data: what happens to us if you are breached, and who pays.
Where insurance comes in
Cyber liability insurance exists for the part of this you cannot prevent. It pays for the forensic investigation, the legal notification of patients, the regulatory response, the ransom negotiation if it comes to that, and the income lost while the systems are down. Carriers now ask about multi-factor authentication, backups and endpoint protection before they quote, and a practice that cannot answer yes is either declined or surcharged. The checklist above is also the application.
Pricing and what the policy covers for healthcare providers are on our cyber liability insurance page. Malpractice cover answers to the patient who was harmed when the systems failed; cyber cover answers to the breach itself. A practice running on cloud systems needs both, and should know which policy excludes what before the morning it matters.
Associated Resources
- Cyber liability insurance for healthcare providers
- Our knowledge base on cyber attacks and why they happen
- Healthcare's cyber risk has become a liability question
Sources
