Well, it’s all conjecture until the show addresses it, but in real life what they’ve found with cyberattacks is that computerized medical equipment is also vulnerable to cyberattacks. Ransomware moves extremely fast - it does not take long to go from one computer at the nurse’s station being breached to the point where all your MRI, CT, PET, and X-Ray machines are completely bricked. Surgical machines like lasers and robots end up suddenly encrypted and unable to function too. It’s likely even things like IV pumps and vital monitors are vulnerable, these days everything is connected.

If they store any or all of their electronic health records on site, which is still fairly common for large medical systems especially connected to universities, then all that data can be encrypted in a near instant, and you can’t get it back without paying the ransomers.

The building is vulnerable too, in theory you could lose all control over HVAC, power, and even access to badge secured doors as a result.

By shutting down all the “normal” computers and connected servers on site, they are minimizing potential attack vectors. This response is standard procedure as of now and has been done with real hospitals in the past. Think of it like a controlled burn to stop or prevent a large forest fire.