Hospital cyberattacks expose the identity gap in healthcare security

At a glance

What this is: This is an Imprivata analysis of why hospital cyberattacks are accelerating and why identity controls, not only infrastructure hardening, are central to reducing exposure in healthcare environments.

Why it matters: It matters because healthcare teams must govern human access, privileged access and connected device access together if they want to limit ransomware impact, protect patient data and satisfy healthcare security obligations.

By the numbers:

• Hospital cyberattacks in Germany increased by 74% from 2020 to 2024, according to Imprivata.

Context

Krankenhäuser sind heute keine reinen IT-Umgebungen mehr, sondern stark vernetzte Identitäts- und Zugriffslandschaften. Wenn alte Systeme, Medizingeräte, mobile Endpunkte und privilegierte Zugänge nicht gemeinsam gesteuert werden, wird der Ausfall eines einzelnen Kontos oder Geräts schnell zu einem Betriebs- und Versorgungsausfall.

Imprivata argues that the core security gap in healthcare is governance across the full access chain, not just perimeter defense. For IAM, PAM and NHI teams, the question is whether access to legacy systems, shared clinical workstations and connected medical devices is continuously controlled, auditable and scoped to the task at hand.

Key questions

Q: What breaks when healthcare identity controls are built on legacy systems?

A: Legacy identity systems often struggle to support many user types, many devices, and hybrid application environments at the same time. That creates inconsistent authentication, weak visibility, and more opportunities for unauthorized access. It also makes it harder to align security with patient experience, operational efficiency, and compliance obligations across healthcare workflows.

Q: Why do connected medical devices increase hospital cyber risk?

A: Connected medical devices increase risk because they expand the identity perimeter and often rely on persistent credentials or weak segmentation. If one device is compromised, the associated access can become a route into other systems. In practice, device identity and network reach must be governed together, not treated as separate technical issues.

Q: How should hospitals prioritise PAM versus general IAM controls?

A: Hospitals should prioritise PAM where elevated access can interrupt care, restore services or reach patient data. General IAM matters across the estate, but privileged access is the control layer most likely to determine whether an intrusion becomes a broad outage. Recovery accounts, admin sessions and exception access deserve the highest scrutiny.

Q: What governance questions should healthcare teams ask after a ransomware incident?

A: Teams should ask who could access critical systems, which accounts were overprivileged, whether devices inherited unnecessary trust, and how quickly elevated access can be revoked during recovery. Those questions expose whether the organisation has controlled the identity gap or merely documented it after the fact.

Technical breakdown

Why legacy hospital systems stay exposed

Many hospitals still run operating systems and applications that have gone years without patching or replacement. That creates a durable attack surface because known vulnerabilities remain available to attackers long after they are publicly documented. In healthcare, this is amplified by operational constraints: medical equipment, clinical workflows and vendor dependencies can delay remediation. The identity issue is that these systems are often protected by weak, shared or legacy authentication patterns, so compromise of one account can expose critical services. Practical implication: map which legacy systems depend on weak or shared credentials and isolate them behind stronger identity controls before other modernisation work.

Practical implication: identify legacy systems that still rely on weak or shared credentials and place them behind stronger identity controls.

Connected medical devices and access scope

Internet of Medical Things environments create dense access relationships between devices, endpoints and hospital systems. A compromised device is not just a malware problem, it becomes an identity problem when that device carries standing access into other systems. Once an attacker reaches a trusted endpoint or device account, lateral movement can follow the trust path rather than the network path. In practice, this makes device identity, session control and segmentation inseparable. Practical implication: treat medical devices as governed identities with explicit scope, not as passive assets that only need network segmentation.

Practical implication: govern medical devices as identities with explicit scope instead of treating them as passive assets.

Privileged access and clinical downtime

Hospitals depend on administrative access for recovery, maintenance and clinical operations, but privileged accounts are also the fastest route to broad compromise when they are not tightly governed. If admin credentials are long-lived, broadly shared or poorly monitored, an attacker can move from initial access to system-wide disruption quickly. The article’s emphasis on logging and real-time monitoring reflects the need to observe privileged use as it happens, not after the fact. Practical implication: enforce privileged access controls that separate recovery access from daily operations and make privileged sessions observable.

Practical implication: separate recovery access from daily operations and make privileged sessions observable.

Threat narrative

Attacker objective: The attacker aims to disrupt hospital operations enough to force recovery activity, extort money or create leverage through downtime and data exposure.

1. Entry typically starts with phishing, exposed systems or a vulnerable connected device that provides an initial foothold into the hospital environment.
2. Credential harvesting or misuse follows when the attacker reaches a trusted account, shared login or privileged session that opens access to additional systems.
3. Escalation occurs as the intruder uses that trust to move across clinical and administrative systems, disrupting availability and access control at scale.
4. Impact is the loss of care continuity, including diverted patients, cancelled procedures, manual workarounds and financial as well as legal exposure.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Healthcare identity governance has become a patient-safety control, not an IT sub-discipline. The article shows that hospital cyber risk now travels through access paths, not only infrastructure faults. When clinical operations depend on old systems, mobile devices and privileged logins, identity controls become part of care continuity. Practitioners should treat access governance as a clinical resilience issue, not a back-office function.

Legacy healthcare environments create identity debt that outlives infrastructure refresh cycles. Hospitals rarely replace every system at the same pace, which means weak authentication and shared access patterns linger long after other security work has started. That is a governance problem because the organisation is maintaining operational dependence on identities that were never designed for modern auditability. The implication is that the programme must inventory and prioritise access paths before it can claim control over the estate.

Connected medical devices turn access scope into a blast-radius question. A device with unnecessary or broad credentials is not merely overconnected, it is overtrusted. In healthcare, that trust can bridge into clinical applications, administration systems and backup paths with very little friction. The practitioner conclusion is that device identity, session scoping and network placement have to be governed together.

Privileged access in hospitals needs separate treatment from ordinary user access. Recovery, maintenance and clinical administration all require elevated access, but the article makes clear that uncontrolled privileged sessions can amplify the effect of any compromise. That aligns directly with PAM governance and NIS2 accountability pressure in critical sectors. The practical conclusion is that hospitals need explicit governance for who can elevate, under what conditions and with what audit trail.

Identity gap is the right named concept for this problem. The article is really describing a gap between operational dependence and governed access. Hospitals often know which systems are critical, but not which identities can reach them, under what circumstances and with what oversight. That gap is what turns a technical incident into a service outage, regulatory event and patient-safety incident.

What this signals

Identity gap: healthcare organisations need a clear model of which identities can reach which clinical assets, because that is where ransomware turns into service disruption. The practical shift is from protecting networks in the abstract to governing access paths for legacy systems, connected devices and emergency administration.

Hospitals that still separate IT security from clinical uptime are missing the operating reality of modern care delivery. Access governance now has to account for patient safety, recovery operations and regulatory exposure in one programme, or the hospital will keep rediscovering the same failure mode in different forms.

For practitioners

• Map clinical identity dependencies Inventory which applications, devices, shared workstations and administrative paths can reach patient data or operational systems, then rank them by blast radius and recovery criticality.
• Separate privileged recovery access Use distinct privileged accounts for maintenance and emergency use, require stronger authentication, and log every elevated session to preserve accountability.
• Treat medical devices as governed identities Assign each connected device a defined access scope, review whether it really needs trust into clinical or administrative systems, and revoke inherited access where it does not.
• Modernise authentication on legacy systems Where older platforms cannot be rebuilt quickly, wrap them with centralized identity controls, stronger authentication and monitored access gateways.
• Test ransomware recovery through identity paths Exercise restoration plans using real access scenarios, including who can re-enable systems, who can approve exceptions, and how quickly privileged access is removed after recovery.

Key takeaways

• Hospital cyberattacks in healthcare are increasingly an access-governance problem, not only a resilience problem.
• Legacy systems, connected devices and privileged credentials create the conditions that let a local compromise become a service outage.
• Healthcare teams should govern identity paths, privileged recovery access and device trust as part of their patient-safety strategy.

Key terms

• Identity Gap: The identity gap is the difference between what an organisation assumes it knows about a customer and what its systems can actually verify across channels. It appears when CRM, CDP, and IAM records do not line up cleanly, causing recognition errors, inconsistent decisions, and weaker trust in downstream fraud and personalization controls.
• Privilege Access Management: Privilege Access Management is the discipline of controlling and monitoring elevated access to critical systems and data. It governs how privileged accounts, credentials, sessions, and commands are issued, used, recorded, and revoked, so administrative power is limited, traceable, and aligned to policy, risk, and operational need.
• Medical Device Identity: The cryptographic and operational identity assigned to a device so backend systems can trust it as a distinct actor. In healthcare, this identity should be unique, revocable, and tied to lifecycle controls such as issuance, rotation, retirement, and validation.
• Legacy authentication: Older login or protocol methods that remain in place for compatibility even after stronger controls exist. They often preserve weaker trust assumptions, which makes them attractive to attackers and difficult to defend if they are not tightly scoped and eventually retired.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.