TL;DR
- The Pitt Season 2 depicts a hospital going analog on the Fourth of July after neighboring hospitals are hit by ransomware. The show captures the toll a security incident can have on the people in the ER who can't stop working.
- Research shows that when a hospital goes down, the disruption doesn't stay contained. Neighboring ERs can see patient volumes and wait times climb as they absorb redirected patients.
- The real-world breaches at Change Healthcare and McKesson show how much damage can follow compromised access, and how far the consequences can extend beyond the organization initially breached.
- Authentication can confirm an account. It doesn't necessarily confirm the human behind it.
The Pitt won Outstanding Drama Series for the second consecutive year at the 78th Primetime Emmy Awards. Each season follows one shift, one day, one team. Season 1 dropped viewers into an ordinary day at Pittsburgh Trauma Medical Center that turned anything but. Season 2 is set on the Fourth of July, adding holiday chaos to an ER that's already operating under pressure.
Nobody Had "Cyberattack" in the Pool
If you've watched The Pitt, you know the betting pool is part of the culture. When something goes sideways — and something always goes sideways — someone starts taking bets on what caused it. It's gallows humor. It's how people who see the worst of things stay sane.
Early in Season 2, the staff learns that patients from a neighboring hospital are being redirected to Pittsburgh Trauma without explanation. The guesses start: a flood, a building collapse, a major accident.
Nobody guesses a cyberattack.
In episode seven, they get their answer. Two neighboring hospitals have been hit by ransomware. Pittsburgh Trauma isn't among them, and as far as the team knows, its systems are secure. But as a precaution, the hospital begins taking patient systems offline.
The attack didn't breach Pittsburgh Trauma, but the disruption reached it anyway.
Going Analog While the ER Keeps Moving
The shift is immediate. A fax machine gets wheeled into the ER, and staff who remember the old workflows start helping those who have never had to use them under pressure.
But going analog means more than swapping an Electronic Health Record for paper. The systems being taken offline are woven into nearly every part of how a hospital keeps track of its patients and coordinates their care.
Patients still need to be tracked, medications still need to be administered, orders still need to get from one person to another. Clinicians still need to know who has been seen, what was done, and what needs to happen next. Information that moved through digital systems minutes earlier now has to move through paper, stickers, whiteboards, fax machines, and people, all while more patients are arriving from hospitals that can no longer take them.
That's what The Pitt captures so well. Pittsburgh Trauma wasn't attacked, but its staff still absorbs the operational consequences of the attack. They're caring for more patients with fewer tools to manage them, while trying to make sure nothing gets lost in the transition.
The Real Incidents Behind the Storyline
While the show is fiction, the pattern it depicts is not, and the most recent example was still making headlines as Season 2 aired.
In August 2026, McKesson discovered that attackers were inside the systems for four days. ShinyHunters hadn't needed a sophisticated exploit to get in. They called McKesson employees, impersonated IT staff using the domain mckesson[.]claims, and social-engineered their way into multiple Okta SSO accounts. From there they reached Salesforce and Snowflake and claimed they walked out with an estimated 1TB of data, demanding $55.2 million before McKesson had told anyone a breach occurred.
Two years earlier, Change Healthcare — which processes roughly 40 percent of all U.S. healthcare claims — went down after an attacker used stolen credentials on a Citrix portal with no MFA. The attackers went undetected for nine days before deploying ransomware. Pharmacies couldn't fill prescriptions, and providers delivered care without reimbursement. Ultimately, 192.7 million Americans were affected, making it the largest healthcare data breach in U.S. history.
The Cost That Doesn't Make the Press Release
The cost of a healthcare breach is usually measured in dollars and records. But some of its most consequential effects show up in patient care.
A 2026 University of Minnesota study found that in-hospital mortality increases by 34 to 38 percent at facilities experiencing a ransomware attack. And the impact doesn't stop at the hospital that was breached.
A study published in JAMA Network Open found that neighboring hospitals experienced a 15% increase in daily ER volume and a 47% increase in median wait times during a nearby ransomware attack. Researchers described the spillover as a regional disaster.
Cybersecurity incidents in healthcare don't stay neatly contained within a network. Their consequences can reach people who had nothing to do with the initial compromise, including the clinicians and patients at the hospital next door.
The Same Diagnosis, Twice
Change Healthcare and McKesson were different attacks, but they exposed the same gap: trusted access did not necessarily mean a trusted human was behind it.
At Change Healthcare, stolen credentials were enough to access a Citrix portal without MFA. At McKesson, attackers reportedly impersonated IT staff and social-engineered their way into employee accounts. In one case, the attacker had the credential. In the other, the attacker convinced someone they were a person who should be trusted.
That's the problem authentication alone can't always solve. A credential can be valid, an account can be trusted, and authentication can confirm the account. But it doesn't necessarily confirm the human.
Health-ISAC warned the sector about social-engineering attacks targeting helpdesks and identity systems in July 2026. McKesson disclosed its breach involving similar tactics the following month. The attack pattern wasn't hypothetical. It was already happening.
The Pitt gets the human cost right in a way most security briefings don't. When the show won its first Emmy for Outstanding Drama Series, creator R. Scott Gemmill dedicated the moment to healthcare workers and frontline first responders: "Respect them. Protect them. Trust them."
Protecting them starts before the breach, not after.
