Ransomware halts a major port, hospital network or pipeline for three days or more
The test Between 26 Oct 2026 and 25 Oct 2027, a ransomware attack in an IMF top-30 economy halts for three days or more the cargo handling or truck gates of a container port, the scheduled care of a health system (three or more hospitals, or ten or more clinics), or the flow of an oil or gas pipeline, as stated by the operator or a national authority.
Not under way · Confidence: medium · Reviewed 25 Oct 2026 · Scores from 1 to 10
This page answers: What could happen, how it is scored, and who is exposed?
Using this page
- Read the two scores: Likelihood and Impact are kept apart.
- Check what is happening, each fact with its source.
- Use the calendar for the dates to watch.
Follow this riskSign in to follow; one weekly email if you ask for it.
Impact is the average of the four parts, rounded, plus one point when Canada is directly hit on two or more channels, up to 10.
Two separate scales from 1 to 10. Strature never multiplies or merges them.
What changed
Dated, newest first
- SafePay has targeted more than 600 victims across critical infrastructure sectors (advisory AA26-293A) [1]
Why it matters
Ransomware against hospitals, ports and other operators is frequent: CISA and the FBI warned on 21 Oct 2026 that SafePay has hit about 600 victims, and a February 2026 attack halted care at UMMC's 35 clinics for more than a week. Another three-day halt is more likely than not, short of the base case; its effects usually stay local.
Why Likelihood 6 Pushes: SafePay alone has about 600 victims; health and energy incidents rising; unpatched VPNs remain the way in. Brakes: one confirmed qualifying halt in the last 12 months; many attacks hit IT only and care continues; port systems recovered within days.
Why Impact 3 One operator's market; days to weeks; diversion to other hospitals or ports at modest cost.
The other facts on file (4)
- Ransomware at UMMC from 19 Feb 2026; care halted at 35 clinics (one dialysis clinic stayed open); reopened 2 Mar 2026 [3] [2] (2 Mar 2026)
- ChipSoft, serving about 70% of Dutch hospitals, breached in April 2026 (CSIS names Embargo); no direct care disruption reported [4] (Apr 2026)
- North Carolina Ports attack detected 4 Aug 2026; gates normal from 7 Aug; not attributed or called ransomware [6] (7 Aug 2026)
- Ransomware is the top cybercrime threat to Canada's critical infrastructure; health incidents +75% and energy +67% 2022-23 [7] (20 Sep 2024)
Where it sits
How it spreads
Between 26 Oct 2026 and 25 Oct 2027, a ransomware attack in an IMF top-30 economy halts for three days or more the cargo handling or truck gates of a container port, the scheduled care of a health system (three or more hospitals, or ten or more clinics), or the flow of an oil or gas pipeline, as stated by the operator or a national authority.
Not under wayChannels 5 on the card
- CanadaHealth and energy are among the fastest-growing targets; no Canadian loss figure.
- Health careA health system on paper cancels appointments, chemotherapy and elective procedures for days or weeks.
- Ports and logisticsManual processing slows gates and cargo.
- EnergyA pipeline halt would move regional fuel prices; no case found this year.
- Insurance and rulesLarge cases raise cyber insurance costs and reporting pressure (Strature's view).
Sectors 3
- Technology
- Ports and logistics
- Energy and pipelines
Who is exposed
- Countries
- United States, Netherlands, South Africa, Australia, Canada
- Sectors
- Technology, Ports and logistics, Energy and pipelines
Three scenarios and their signposts
- S1
Steady drumbeat
One or two health systems or ports go down for days; recovery within two weeks.
- S2
A long outage at a hub
A port or pipeline is down for a week or more and regional supply chains feel it.
- S3
Quieter year
Arrests and takedowns cut activity.
| Path | Signpost |
|---|---|
| S1 | a new CISA #StopRansomware advisory naming hospitals, by 30 Apr 2027 |
| S2 | an operator on manual processing for more than three days, by 25 Oct 2027 |
| S3 | fewer new victims in CISA updates by 30 Apr 2027 |
No probability is given for the three paths.
Dates to watch
The dates to watch
A dot is a day, a bar a month or a year; a hollow mark is tentative. The line marks today.
- 25 Oct 2027 End of the scored window Declared · Strature date
Sign in, with alerts on, for an email 7 days and 1 day before.
The other side
Each public case spreads tested defences (patching, multifactor sign-in, offline backups, segmentation, the advisory's asks); Canadian cyber security and incident response firms meet steady demand (Strature's view).
Connected in Strature
- United States
- Canada
- Netherlands
- Australia
- South Africa
- A state-linked cyber attack cuts power, water or a port for a day or more Shares a channel: State-linked actors positioned in the same critical networks (CISA AA26-281A, 8 Oct 2026).
- Allies publicly blame China for a new break-in to critical infrastructure Shares a channel: Intrusions into the same critical infrastructure sectors.
Sources
6 sources, numbered as the text cites them
- CISA, FBI and partners warn organizations of SafePay ransomware actors targeting multiple critical infrastructure sectors. CISA · 21 Oct 2026 · Official · confidence high · retrieved 25 Oct 2026
- Mississippi medical center reopens clinics hit by ransomware attack. BleepingComputer · 4 Mar 2026 · News · confidence medium · retrieved 27 Oct 2026
- Mississippi health system shuts down clinics statewide after ransomware attack. NPR via HPPR · 21 Feb 2026 · News · confidence high · retrieved 25 Oct 2026
- Significant Cyber Incidents. Center for Strategic and International Studies · 2026 · Think tank · confidence medium · retrieved 25 Oct 2026
- North Carolina Ports confirms cyberattack disrupting operations. BleepingComputer · 7 Aug 2026 · News · confidence medium · retrieved 25 Oct 2026
- National Cyber Threat Assessment 2025-2026. Canadian Centre for Cyber Security · 20 Sep 2024 · Official · confidence high · retrieved 25 Oct 2026
Reviewed 25 Oct 2026 · version 1 · last change: reviewed · All risks