If charges are brought, it would be a rare case of hacking with fatal consequences.
Düsseldorf University Hospital's IT systems were knocked offline in the attack last Thursday, meaning it became disconnected from the ambulance network.
A critically ill woman was therefore admitted to a hospital further away in Wuppertal and died shortly afterwards, the Düsseldorf hospital revealed this week.
Because of the longer distance that the ambulance had to travel, there was an hour's delay before medical staff were only able to treat her.
Prosecutors in Cologne have taken over the investigation and are now probing unknown suspects on suspicion of manslaughter, prosecutor Christoph Hebbecker said Friday.
“We are now investigating over involuntary manslaughter, computer sabotage and attempted blackmail,” he told AFP.
He added that investigations are in particular looking into “whether there is a criminal connection between the hacking and the death of this person”.
The hackers exploited a “weakness in an application” to encrypt several servers, the hospital said Thursday, but there was no evidence that “data had been irretrievably destroyed”.
Isabel Pfeiffer-Poensgen, science and culture minister for the state of North Rhine-Westphalia, said Thursday there was evidence to suggest the attack had been aimed at Düsseldorf's Heinrich Heine University (HHU).
Pfeiffer-Poensgen said a threatening letter had been found on a HHU server.
According to the hospital, however, there was no concrete ransom demand.
Access to the data encrypted during the attack has now been restored and systems are being gradually brought back into operation.
Germany has seen several hacker attacks on research and higher education institutions in recent months, including the University of Giessen, the University of Cologne and the Ruhr University Bochum.