Ransomware Attacks on Healthcare: A Growing Tech Crisis

The digital infrastructure of modern medicine is facing an unprecedented threat level. While cybersecurity used to be a background concern for hospital administrators, it has now become a critical patient safety issue. Recent attacks on major healthcare providers have exposed deep vulnerabilities in the technology that hospitals rely on to save lives, forcing doctors to revert to pen and paper while critical systems remain locked by cybercriminals.

The Surge of High-Profile Attacks

The year 2024 marked a turning point in the severity and scale of ransomware attacks targeting the healthcare sector. These were not isolated incidents but coordinated efforts by sophisticated criminal organizations to cripple infrastructure for financial gain.

The Change Healthcare Incident

In February 2024, Change Healthcare, a subsidiary of UnitedHealth Group, fell victim to a massive ransomware attack. This was arguably the most significant attack on the U.S. healthcare system to date. Change Healthcare processes billing for a vast network of hospitals and pharmacies. When their systems went down, patients across the country could not fill prescriptions, and smaller medical practices stopped receiving payments, pushing some to the brink of bankruptcy.

UnitedHealth Group admitted to paying a ransom of $22 million to the cybercriminal group known as ALPHV, or BlackCat. Despite the payment, the recovery process took months, highlighting that even paying the demand does not guarantee an immediate return to normalcy.

The Ascension Health Breach

shortly after the Change Healthcare incident, Ascension, one of the largest non-profit health systems in the United States, suffered a major ransomware attack in May 2024. The attack forced hospitals in multiple states to divert ambulances and pause elective procedures. Doctors and nurses lost access to Electronic Health Records (EHR), meaning they could not look up patient histories, medication allergies, or test results digitally. Staff had to physically run messages between departments and maintain paper charts, drastically slowing down care delivery.

The Synnovis Attack in London

The crisis is global. In June 2024, major London hospitals were disrupted by an attack on Synnovis, a pathology service provider. The attack was claimed by a Russian-speaking group called Qilin. This breach led to the cancellation of over 1,000 operations and thousands of appointments because hospitals could not process blood tests.

Why Healthcare Technology is Vulnerable

Hospitals are unique environments that face specific technological challenges. These factors make them attractive targets for ransomware gangs.

Legacy Infrastructure Many medical devices, such as MRI machines, CT scanners, and heart monitors, run on outdated operating systems. It is common to find expensive medical equipment still running on Windows 7 or older Linux kernels. These systems are often no longer supported by manufacturers, meaning they do not receive security patches. If a hacker finds a way in, there is no digital lock to stop them.

The Internet of Medical Things (IoMT) Modern hospitals are hyper-connected. Infusion pumps, patient monitors, and even hospital beds are connected to the network to send data to central stations. This creates a massive “attack surface.” A hacker does not need to breach the main server directly; they can enter through a poorly secured smart thermostat or a connected printer and move laterally through the network to reach sensitive patient data.

Third-Party Risk As seen in the Change Healthcare and Synnovis attacks, hospitals rely heavily on outside vendors for billing, payroll, and diagnostics. A hospital might have excellent internal security, but if one of its vendors is compromised, the hospital suffers the consequences. This supply chain vulnerability is the current weak point for the entire industry.

The Economics of Healthcare Ransomware

Cybercriminals target healthcare because it is lucrative. According to IBM’s Cost of a Data Breach Report, healthcare has had the highest average data breach cost of any industry for over a decade. In 2023, the average cost of a healthcare breach reached nearly $11 million.

High Value of Data Patient data is worth significantly more on the dark web than credit card numbers. A medical record contains unchangeable information: names, birth dates, social security numbers, and medical histories. You can cancel a stolen credit card, but you cannot change your medical history. This makes the data valuable for identity theft and long-term fraud.

The Urgency to Pay Ransomware groups operate on a model of “pressure.” In other industries, a company might rely on backups and wait out the attack. In healthcare, downtime equals danger. If a stroke center cannot access imaging software, patients could suffer permanent damage or death. Attackers know this moral pressure forces administrators to pay ransoms quickly to restore systems.

The Attackers: Who is Behind the Keyboards?

The groups attacking hospitals are not lone wolves. They are organized criminal enterprises, often operating out of jurisdictions that do not cooperate with Western law enforcement.

• BlackCat (ALPHV): Known for the Change Healthcare attack, this group operates on a “Ransomware-as-a-Service” (RaaS) model. They develop the malware and rent it out to affiliates who conduct the attacks. They are known for their ruthlessness and aggressive negotiation tactics.
• LockBit: One of the most prolific ransomware groups globally. They have targeted hospitals in the U.S. and Europe. They often threaten to publish sensitive patient photos or data if payment is not made.
• Qilin: The group behind the London Synnovis attack. They are known for double extortion, where they encrypt the data to lock the system and steal the data to threaten public release.

Strengthening the Digital Defenses

Fixing this crisis requires a shift in how healthcare organizations view technology. Security cannot be an afterthought.

Network Segmentation Hospitals must separate their networks. The Wi-Fi used by patients and guests should never touch the network used by medical devices. Furthermore, the network for life-support systems should be isolated from the administrative network used for email and billing. If an employee clicks a phishing link, the infection should be contained to the office computers and not spread to the operating room.

Offline Backups The only way to recover from ransomware without paying is to have clean backups. However, sophisticated malware hunts for backups to encrypt them too. The gold standard is “immutable” or air-gapped backups. These are copies of data stored offline or in a state that cannot be altered or deleted, ensuring a restoration point exists even in a worst-case scenario.

Multi-Factor Authentication (MFA) Many breaches begin with stolen credentials. Implementing strict MFA for all remote access is mandatory. This ensures that even if a hacker steals a doctor’s password, they cannot access the system without the second form of verification, such as a code from a mobile app.

Frequently Asked Questions

Does paying the ransom guarantee the data is safe? No. The FBI and cybersecurity experts advise against paying ransoms. Paying funds criminal activity and encourages future attacks. Furthermore, there is no guarantee the hackers will delete the stolen data or provide a working decryption key. Change Healthcare paid $22 million, yet still faced months of disruption.

Is my medical data at risk if my hospital is hacked? Yes. In many ransomware attacks, hackers steal data before locking the system. This is called “double extortion.” They threaten to release the data to force payment. If your hospital is breached, you should monitor your credit reports and medical billing statements for suspicious activity.

Why don’t hospitals just update their software? It is complicated and expensive. Medical devices are regulated by the FDA. Updating the software on an MRI machine often requires recertification or specific manufacturer approval. Additionally, replacing multi-million dollar equipment simply because the operating system is old is not financially feasible for many cash-strapped hospitals.

What is the government doing about this? The U.S. government is increasing pressure on the industry. The Department of Health and Human Services (HHS) has introduced new voluntary cybersecurity performance goals. There is also ongoing discussion about linking Medicare payments to basic cybersecurity hygiene standards, effectively forcing hospitals to upgrade their security to receive federal funding.