Healthcare cybersecurity gaps expose data, devices and uptime risks

At a glance

What this is: This is a healthcare cyber risk analysis arguing that data exposure, ransomware, legacy infrastructure, insecure devices and weak governance combine to threaten patient data and uptime.

Why it matters: It matters to IAM and security teams because healthcare risk here is not just perimeter defence, but controlling access, documenting governance and reducing the attack surface across users, devices and cloud services.

By the numbers:

• The average cost of a healthcare data breach was $9.6 million in 2021, according to GlobalSign.
• Approximately five million insecure medical devices were operating through IoT and IoMT in 2020, according to GlobalSign.
• The article says healthcare breaches had generated losses of $6 trillion by the end of 2020, according to GlobalSign.

Context

Healthcare security fails when clinical availability, patient data protection and governance are handled as separate workstreams. In practice, a weak control in one layer quickly becomes an operational problem in another, especially where legacy systems, connected devices and broad user access all share the same environment.

The article's central point is that healthcare is structurally exposed because it combines high-value data, time-sensitive operations and a large attack surface. That makes the identity and access layer especially important, because phishing, insider misuse and insecure remote access often become the entry point to wider disruption.

Key questions

Q: What breaks when healthcare organisations treat access, devices and governance as separate problems?

A: They create overlapping gaps that attackers can chain together. A phishing email, a weak legacy system or an insecure medical device may not look severe alone, but each can become the entry point to patient-data theft or service disruption when governance is fragmented. The practical failure is not one control missing, but the absence of an integrated access and resilience model.

Q: Why do privileged accounts and insider misuse create such high risk in healthcare environments?

A: Privileged accounts create high risk because they can reach the systems and records that matter most, while insider misuse can bypass many perimeter controls. In healthcare, cloud services, third-party access, and remote work expand the attack surface, so a single over-privileged account or human error can expose large volumes of sensitive patient data quickly.

Q: How should healthcare teams reduce the risk from legacy systems and IoMT devices?

A: Start by mapping the systems and devices that cannot be quickly patched or replaced, then isolate them from broader networks and reduce the access they can reach. If an asset is critical to care delivery, it needs stronger segmentation, tighter account control and a clearer replacement plan than a standard endpoint.

Q: Which control failures matter most for healthcare governance and compliance?

A: The biggest failures are weak access control, poor documentation and inconsistent monitoring. Those gaps make it hard to prove who had access, what changed and whether controls were tested. For healthcare teams, the issue is not only regulatory compliance but also whether governance can support safe operations during an incident.

Technical breakdown

Why healthcare data breaches become operational incidents

Healthcare data is valuable not only because it is sensitive, but because it is operationally useful to attackers. Patient records, treatment data and account details can support fraud, extortion or follow-on access. When security controls around access, encryption and monitoring are weak, a breach stops being only a confidentiality issue and becomes a business continuity issue. In healthcare, that shift matters because downtime can delay care, disrupt workflows and undermine trust across clinicians, patients and partners.

Practical implication: treat patient-data exposure and service disruption as the same governance problem, not separate risk registers.

How phishing and insider misuse turn identity into the attack path

Phishing works in healthcare because it targets human decision-making at scale, usually by stealing credentials or convincing users to approve access they should not grant. Insider misuse is the same control failure from the inside, where valid access is used for theft or sabotage. Both patterns show that authentication alone is not enough. If privileges are too broad, monitoring is weak and user awareness is low, valid identities become an efficient route to data theft or operational disruption.

Practical implication: pair authentication with privilege restriction, behavioural monitoring and user awareness controls.

Why legacy systems and insecure medical devices expand the blast radius

Legacy platforms and IoMT devices are difficult to patch, hard to inventory and often integrated into critical workflows. That creates an environment where the attack surface is not just larger, but also harder to govern. Inaccessibility, vendor dependencies and uptime concerns can delay remediation, which leaves known weaknesses in place longer than they should remain. For healthcare, that means a compromise can spread from one weak endpoint or device into broader operational systems.

Practical implication: maintain an inventory of legacy and connected devices, then prioritise segmentation and replacement around clinical criticality.

Threat narrative

Attacker objective: The attacker wants access to sensitive patient data, operational disruption and leverage over a healthcare organisation's ability to deliver care.

1. Entry typically begins with phishing, malicious attachments or a weakly protected legacy service that gives the attacker an initial foothold.
2. Credential access or insider misuse then turns that foothold into legitimate-looking access, allowing the attacker to reach sensitive patient data or administrative systems.
3. Escalation follows when broad privileges, flat networks or weak device controls let the attacker move from one system to wider operational disruption.
4. Impact is data theft, ransomware encryption, service interruption or loss of treatment availability across the healthcare environment.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Healthcare cyber risk is an access-governance problem before it is a malware problem. The article shows that phishing, insider misuse, cloud exposure and insecure devices all become more dangerous when organisations treat each as a separate issue. In healthcare, the access layer is the control plane for patient data, clinical uptime and third-party workflows. Practitioners should read this as a governance failure of scope, not a single-control gap.

Legacy systems create a standing-risk model that modern security teams underestimate. Old platforms do not merely lag on patches. They also lock organisations into fragile access patterns, weaker monitoring and slower change cycles, which makes every other control harder to enforce. That is especially important in healthcare, where operational tolerance for downtime often delays remediation. Practitioners need to treat technical debt as an identity and resilience constraint, not just an infrastructure one.

Device sprawl and cloud adoption widen the trust boundary faster than governance matures. The article's combined focus on IoMT, cloud and documentation points to a common pattern: the environment evolves faster than the policies that define who or what is allowed to act inside it. Healthcare trust boundary drift: the gap between deployed systems and governed access scope is now a primary source of risk. Practitioners should map that drift explicitly and reduce it through inventory, segmentation and reviewable access policy.

Awareness is necessary, but awareness without enforceable identity controls is operationally thin. The article correctly includes user education, yet the more durable fix is to make compromised credentials and excessive privilege less useful. That means governance over account lifecycle, access approval, monitoring and offboarding has to sit alongside training. Practitioners should expect awareness to reduce mistakes, but not to compensate for weak entitlement design or unmanaged device access.

What this signals

Healthcare cyber resilience now depends on shrinking the gap between governed access and operational reality. When clinical systems, cloud services and connected devices are managed under different assumptions, the result is drift that attackers can exploit. Practitioners should expect identity review, device inventory and documentation discipline to become more important together, not separately.

Healthcare trust boundary drift: the pace of digital change in hospitals is outstripping the governance needed to control who and what can act in the environment. That makes inventory, entitlement review and segmentation the practical levers for reducing blast radius before incidents turn into care disruption.

For practitioners

• Tighten access around clinical and administrative data Review who can reach patient records, device consoles and cloud repositories, then remove broad access that is not tied to a current role or workflow.
• Inventory legacy and connected devices Build a current register of legacy systems, IoMT devices and remote services so you can segment high-risk assets and prioritise replacement by clinical criticality.
• Treat phishing as an identity control issue Pair user awareness with MFA, conditional access and rapid credential revocation so a compromised mailbox or portal session does not become a wider breach path.
• Document security governance and review cadence Maintain written policies, required actions, completed security activities and testing records so healthcare controls remain auditable and repeatable over time.

Key takeaways

• Healthcare security failures in this article are not isolated problems but a linked pattern of data exposure, ransomware, legacy risk, device insecurity and weak governance.
• The article ties the sector's exposure to scale and impact, including large breach costs, repeated ransomware activity and millions of insecure devices in operation.
• The strongest response is to govern access, inventory and documentation as one resilience model rather than separate compliance tasks.

Key terms

• IoMT: IoMT means Internet of Medical Things, the connected medical devices and systems used in clinical care. These devices often have long lifecycles, limited patchability, and strict uptime requirements, which makes compensating controls such as segmentation especially important.
• Legacy software risk: The security and operational exposure created when older systems remain in production after their support window has closed or their design assumptions no longer match the environment. In practice, risk grows through patch gaps, hidden dependencies, and weak ownership.
• Access Governance: Access governance is the policy and workflow layer that manages how access is requested, approved, certified, and revoked. In SaaS environments it helps standardise control across many applications, reducing inconsistency between teams. It is most effective when it covers both human accounts and non-human identities.
• Healthcare Identity Resilience: The ability of a healthcare organisation to maintain safe, auditable, and timely access to clinical systems during disruption. It combines identity assurance, credential governance, and revocation speed so that care delivery can continue without opening avoidable security gaps.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners align identity controls with the operational risk that healthcare and other critical environments face.