Cyber threats in the healthcare sector aren’t simply a matter of lost finances or data theft; they can directly impact patient safety.
In recent years, healthcare organizations have fallen victim to cyberattacks that exploit vulnerabilities in cloud configurations, connected medical devices, and third-party providers. Now, in 2026, the risks continue to grow.
Keep reading to learn about the most at-risk systems as well as the critical steps healthcare organizations should take in order to protect patients and minimize disruptions.
Overview of Cybersecurity in the Healthcare Industry
- Within the first three quarters of 2025, there were more than 360 reported healthcare breaches resulting in the exposure of the personal data of more than 33M Americans.
- In 2024, the protected health information of more than 259M Americans was hacked.
- Today, the average cost of a healthcare data breach is $3.5M. Each breached record costs an organization nearly $400.
- 12% of healthcare organizations experienced cyberattack losses of more than $500K in the past year. That’s compared to 6% of businesses across other industries.
- In the past year, 72% of healthcare organizations reported experiencing an attack that affected patient care. More than 29% said the disruption increased patient mortality rates.
Top Cybersecurity Vulnerabilities for Healthcare Companies
In 2024, 14 healthcare data breaches involved the personal information of more than 1M patients. Together, they exposed the information of nearly 70% of Americans.
With these record-breaking numbers, healthcare companies are more focused than ever on closing their most pressing vulnerabilities. Here’s an overview of the top four.
Unsecured Cloud Systems
Over the last 20 years, healthcare organizations have undergone a massive digitization of data and, more recently, they’ve transformed their data storage strategies.
Healthcare leaders traditionally favored on-premise data storage because it provided strict access control and complied with regulations. This strategy became a huge obstacle when virtual care became the norm during the pandemic. Now, healthcare leaders have shifted their focus to the cloud for better access and reliability.
About 80% of healthcare organizations have adopted cloud computing solutions.
However, 57% of healthcare leaders say they’re not able to manage their cloud environment “very effectively, ” opening a host of vulnerabilities for cybercriminals to exploit.
In 2024, poor cloud cybersecurity led to user account compromises in nearly 75% of healthcare organizations running cloud-based systems.
Overpermissioned accounts, infrastructure misconfigurations, insufficient monitoring, and unsecured APIs are just a few cybersecurity risks associated with cloud-based systems.
For example, in April 2025, Blue Shield of California announced that it had misconfigured cloud-based Google Analytics tracking on its website. This resulted in the organization inadvertently sending the protected health information of 4.7M people to Google Ads over a period of nearly three years.
Vulnerable Internet of Medical Things (IoMT)
Smart medical devices can drastically improve patient outcomes by enabling continuous monitoring and real-time data analysis, but these devices introduce cybersecurity vulnerabilities that are difficult to remedy.
One research paper stated that nearly half of all IoMT devices are not properly secured against cybersecurity threats.
At the network level, these devices are susceptible to man-in-the-middle attacks and data interception. The application level can easily be attacked with malware and ransomware, and the edge layer is prone to data breaches and unauthorized access.
In addition, the IoMT is so disparate that no standardized system of patch management truly exists. There’s also no standardized approach to monitoring or auditing, so unauthorized data changes in patient records may go unnoticed.
A recent analysis from Verizon found that only 54% of IoMT device vulnerabilities were fully remediated after one year of being discovered. For those that were fixed, it took an average of 32 days to accomplish.
In 2024, IT researchers found nearly a dozen security issues with a GE ultrasound, and in 2022, an analysis of 200K infusion pumps found that 75% of them had security issues.
Rapidly Expanding Supply Chains
Nearly 85% of healthcare organizations use 20+ software vendors.
Each vendor presents an additional attack surface for healthcare organizations. In fact, vendors are often prime targets because cybercriminals know that hacking one system will allow them access to dozens, if not hundreds, of healthcare systems.
Between 2024 and 2025, the number of breaches in the healthcare sector that involved a third-party provider doubled, from 15% to 30%.
In the past year, several software supply chain attacks have been carried out by Russian actors, with at least one being politically motivated.
For example, one Russian group targeted Synnovis, a third-party pathology provider in the UK, with a ransomware attack in June 2024. The hackers locked Synnovis’ entire computer system and demanded a $50M ransom. They also leaked nearly 400GB of patient information and private data.
This cyberattack led to almost 600 “incidents” and one death across London hospitals and medical offices, mainly due to the fact that blood tests that previously could’ve been completed in less than an hour were taking up to six hours to process.
Lack of Resources
Nearly half of healthcare organizations say they don’t have enough budget to provide effective cybersecurity.
On average, healthcare organizations devote 6% of their IT budgets to cybersecurity. Nearly 40% of healthcare IT executives said their budget was either staying the same or decreasing in 2025.
In a recent survey, a lack of technology resources and a lack of expertise were cited by about half of healthcare cybersecurity professionals.
A recent survey echoes these findings: only 14% of healthcare IT security teams say they’re fully staffed.
The cybersecurity talent shortage is likely to continue.
Almost 75% of healthcare leaders say that hiring cybersecurity professionals is a significant workforce challenge, and globally, there are nearly 5M cybersecurity vacancies.
Understaffed cybersecurity teams can lead to costly cyberattacks. According to IBM, the talent shortage is responsible for adding $1.76M to the average cost of a data breach.
Cybersecurity Tools for Healthcare Organizations
Despite growing risks, many healthcare systems aren’t using the right cybersecurity tools.
For instance, about 20% of hospitals still don’t use multi-factor authentication.
Deploying the right cybersecurity tools can not only protect IT systems, but can also ease the burden placed on IT staff and give healthcare companies a chance to get ahead of cyber criminals.
Privileged Access Management (PAM)
More than a quarter of breaches in the healthcare industry come from unauthorized access.
Privileged access management (PAM) ensures that users (and machines) only have access to the tools and systems that are required for their jobs. If they need access to an additional system, they can be authenticated and granted just-in-time access that only applies in a specific window of time and is automatically revoked once the time runs out.
PAM solutions also enable IT teams to record privileged sessions and track what a user is doing, making it much easier to detect suspicious activity. For instance, PAM tools analyze the time of day, location of the user, the typical behavior of the user, and other metrics when detecting risks.
This added security layer can be used to protect sensitive operations like editing electronic health records, accessing database servers, and managing IoT devices.
Poor access management policies led to a massive cyberattack on Ascension hospitals in May 2024.
Because some Ascension users had permanent local administrator permissions, cyber criminals were able to execute malicious code and spread it laterally through the network. The attack took place on May 8 and involved more than 5.6M patient and employee records.
The attack crippled Ascension’s EHR system, forcing hospital workers to treat patients via paper charts. The hospitals didn’t return to normal operations until June 14.
IoMT Hardening
It’s estimated that hospitals have between 10 and 15 connected medical devices per bed. In addition to that, there are countless laptops, tablets, and desktops in a hospital. Add it all up, and there can be more than 350K endpoints in one hospital.
Protecting the IoMT must be a priority for hospitals and medical companies. Here are a few of the best ways to do that.
- Full asset inventory: Automated discovery tools catalog each device’s operating system, IP address, open ports, and firmware version. Teams can use this inventory to prioritize vulnerabilities and critical risks.
- Endpoint detection and response: EDR tools provide real-time endpoint threat monitoring. Using behavior analytics, EDR solutions can detect ransomware before it enters the system and automatically take steps to stop threats. Typically, EDR acts in seconds to isolate the infected devices or files and block network communication to ransomware domains. EDR can also provide information about exactly which files the attackers accessed and if any data was leaked.
- Network segmentation: In order to limit the risk of lateral movement of a threat, healthcare organizations should divide their networks into isolated zones on separate VLANs. Devices can be grouped together based on their type or role, ensuring they can only communicate with the systems they need in order to perform their functions. Specific policies dictate access and restrictions for each segment.
Zero-Trust Architecture (ZTA)
The ZTA, “never trust, always verify,” approach focuses on protecting the internal network from lateral movements in the event of an attack. Even if a device or user is on the network, their identity is still verified before any access is granted.
Two cybersecurity strategies discussed earlier, PAM and network segmentation, are important components of ZTA.
In addition to PAM, many ZTA setups take an incredibly strict approach to identity management, implementing multi-factor authentication, hardware security keys, and continuous authentication monitoring.
Implementing a software-defined perimeter is another important step in building a ZTA. The perimeter hides all network resources until the user is authenticated. This way, hackers can’t search for open ports.
Throughout the entire network, context-aware access policies ensure that users are never granted access simply because of their credentials. Instead, policy engines analyze the device’s security, the location of the user, and the sensitivity of the data. For example, a nurse may not be allowed access to patient information if she’s working from a public WiFi network.
Third-Party Risk Management (TPRM)
The healthcare industry experiences more third-party software attacks than any other industry.
In fact, recent research found that healthcare organizations are the victims in more than 40% of all third-party data breaches.
The Change Healthcare cyberattack in February 2024 showed just how widely devastating an attack on a third-party vendor can be.
Change Healthcare, a processor of claims and payments for thousands of healthcare organizations, fell victim to a ransomware attack that resulted in a data breach involving 192M people.
More than 80% of the affected hospitals reported that the breach severely impacted their cash flow. Many organizations reported revenue losses of more than $1M per day.
Here are the main guidelines to remember in establishing a TPRM program.
- Establish the program before the vendor relationship begins. Executive leadership, legal teams, and IT should all define acceptable risk levels for each category of vendor. Before the contract begins, IT teams should have a system in place for organizing the data related to their TPRM program. If there is a breach, this data will be critical to the investigation.
- Build TPRM principles into the vendor selection process. Require vendors to present SOC 2 Type II reports, HITRUST certifications, results of internal testing, and proof of cyber insurance. If needed, require vendors to provide the same for fourth-party vendors and subcontractors.
- Insist on contractual protections like mandatory security updates, audit rights, strict attack notification policies, and financial penalties in the event of an incident.
- Still, prepare for a cyberattack. Develop incident response plans so that IT teams can maintain critical systems even if the third-party vendor is attacked. Create a contingency plan to guide the organization in the event of an attack that causes an extended outage.
AI Is Changing Healthcare Cybersecurity
Thousands of healthcare organizations are implementing AI solutions to accelerate diagnoses, review imaging, and even perform AI-assisted robotic surgery.
At the same time, cybercriminals are increasingly utilizing AI to prey on healthcare organizations and exfiltrate valuable data.
Here are the most concerning AI-powered cyber threats and a few ways the healthcare sector is fighting back with AI tools of its own.
AI-Powered Cyber Threats
Overall, nearly 40% of healthcare organizations say that they’ve adjusted their cybersecurity strategy to counteract AI-powered threats.
Aiming to exploit the sector’s reliance on third-party vendors, cybercriminals are using AI to improve their vendor email compromise attacks. Between 2023 and 2024, there was a 60% increase in this type of attack in the healthcare industry.
Cybercriminals can use AI to impersonate the communication style of service providers and suppliers. These emails are so convincing that more than 70% of employees who read one go on to interact with it in some way.
Healthcare networks may also be attacked by AI-powered polymorphic malware. This specific type of malware can adapt in real time by changing its code and evolving each time it infects a new system.
Using AI to Improve Cybersecurity
According to one survey, half of all healthcare organizations are already using AI in their cybersecurity tools, and an additional 40% say they’ll be implementing AI tools by the end of 2025.
One of the top use cases for AI is threat detection. AI solutions can automate behavior analysis and identify concerning patterns, even within the most sophisticated threats. They work with unprecedented speed, too—one AI-powered tool can analyze 4.7T events per day.
Using AI to automate threat detection is especially impactful for hospital IT staff who are responsible for protecting thousands of IoMT devices. These tools provide added security and also free up IT professionals to do other high-value work.
Healthcare IT teams can also use AI tools to perform automated incident response. If the tools find a threat, they flag it for human review and automatically contain it. The tools can automatically step up security by blocking IP addresses, isolating endpoints, or suspending suspicious user accounts.
McLaren Health: A Healthcare Cybersecurity Case Study
McLaren Health, a Michigan-based hospital system, suffered two major ransomware attacks between 2023 and 2024.
The first occurred in October 2023 when the ALPHV/BlackCat ransomware group reportedly stole the data of at least 2.5M patients.
McLaren was hit again in July 2024 when the Inc. Ransom ransomware group gained access to the organization’s network. This group, which had already successfully attacked several other hospital groups, used spearfishing and compromised credentials as its main modes of attack. The attack compromised the personal health information of more than 743K patients.
McLaren’s IT systems were not restored until more than a month later.
The forensic analysis wasn’t complete for another 10 months. To make matters worse, McLaren waited until that time to notify patients that their data was compromised.
Conclusion
The digital footprint of the healthcare sector is sure to continue its rapid expansion in the coming years. That means there will be even more assets and surfaces to protect.
In order to build cyber resilience, healthcare organizations must adopt a security-focused culture that includes all users, from executives to vendors to patients.
AI tools offer automation and provide enhanced security, but companies will need to deploy additional strategies regarding identity management, network segmentation, and device security in order to be truly protected.