Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Provider failure under a ransomware wave

A conditional statement under stated assumptions, never a prediction.

2 min read0 figures0 tables3 notesNR-SECTOR-CYBER-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1The digital layer is where the systems meet
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Provider failure under a ransomware wave
    1. 5.1 Assumptions
    2. 5.2 The cascade, step by step
    3. 5.3 The scenario as a table of steps
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

5.1Assumptions

Scenario SCN-GS13-CPF-01: what is assumed, and what is held constant.

Baseline
the 2026 reference state in this edition
Drivers
a faulty update or outage at a provider used across sectors that coincides with a ransomware wave on health and public services and a loss of connectivity on one regional route
Analogues
the July 2024 content update failure14; health ransomware attacks of 2016 to 202123; cable faults12
Interventions
none modelled: the specification describes the unmitigated case
Run state
narrative specification; quantified run scheduled for 2027

5.2The cascade, step by step

  1. 1

    INF → ALL

    a faulty update disables endpoints in several sectors at once

    2024

  2. 2

    DAT → HLT

    ransomware hits hospitals while recovery teams are busy elsewhere

    2016 to 2021

  3. 3

    INF → TRD

    a cable fault cuts redundancy for one region

    annual

  4. 4

    INF → ENE

    control and billing systems are degraded or switched to manual operation

    not observed here

  5. 5

    DAT → FIN

    payment and fraud handling is interrupted

    2025

  6. 6

    HLT → INF

    clinics fall back to paper while data recovery is delayed

    2016 to 2021

5.3The scenario as a table of steps

How the shock in scenario SCN-GS13-CPF-01 would travel through Global Cyber and Digital Systems‘s coupled systems, step by step, under the assumptions the edition states.

StepWhat happensSource
01 Infrastructure to allA faulty update disables endpoints in several sectors at once. Analogue or source: 2024.Edition GS-13, scenario SCN-GS13-CPF-01, step 1
02 DAT to healthRansomware hits hospitals while recovery teams are busy elsewhere. Analogue or source: 2016 to 2021.Edition GS-13, scenario SCN-GS13-CPF-01, step 2
03 Infrastructure to tradeA cable fault cuts redundancy for one region. Analogue or source: annual.Edition GS-13, scenario SCN-GS13-CPF-01, step 3
04 Infrastructure to energyControl and billing systems are degraded or switched to manual operation. Analogue or source: not observed here.Edition GS-13, scenario SCN-GS13-CPF-01, step 4
05 DAT to financePayment and fraud handling is interrupted. Analogue or source: 2025.Edition GS-13, scenario SCN-GS13-CPF-01, step 5
06 Health to infrastructureClinics fall back to paper while data recovery is delayed. Analogue or source: 2016 to 2021.Edition GS-13, scenario SCN-GS13-CPF-01, step 6

A teaching model of a conditional scenario under the edition’s stated assumptions: not a forecast, not a prediction and not a warning. Sources: Global Cyber and Digital Systems 2026, scenario SCN-GS13-CPF-01 (2026); Global Cyber and Digital Systems 2026, references (NR-CIT-1) (2026).

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 14CrowdStrike (ed.), External Technical Root Cause Analysis: Channel File 291 (August 2024). CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
  2. 23Neprash, H.T. et al., Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021, JAMA Health Forum 3(12), e224873, 2022 (open access full text). American Medical Association, Chicago. Observation year 2022 (data 2016 to 2021). Accessed 2026-11-03.back
  3. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 5: Provider failure under a ransomware wave. In Nexus Global Cyber and digital systems Risk and Resilience Report 2026: Baseline Edition, The State of the World’s Cyber and Digital Systems. (Baseline Edition 2026, Report No. NR-SECTOR-CYBER-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Global Cyber and Digital Systems.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskGlobal Sector Risk and Resilience

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices