Topic starter
24/06/2026 11:23 pm
TL;DR: Hospital cyberattacks rose 74% in Germany from 2020 to 2024, while ransomware cases have repeatedly disrupted care, forced patient diversions, and created legal and financial exposure, according to Imprivata. The core issue is not just resilience but identity governance for legacy systems, connected devices, and privileged access across healthcare environments.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Hackerangriffe auf Krankenhäuser: Wie können sich Krankenhäuser besser schützen?”.
By the numbers:
- Hospital cyberattacks in Germany increased by 74% from 2020 to 2024, according to Imprivata.
Key questions
Q: What breaks when healthcare identity controls are built on legacy systems?
A: Legacy identity systems often struggle to support many user types, many devices, and hybrid application environments at the same time.
Q: Why do connected medical devices increase hospital cyber risk?
A: Connected medical devices increase risk because they expand the identity perimeter and often rely on persistent credentials or weak segmentation.
Q: How should hospitals prioritise PAM versus general IAM controls?
A: Hospitals should prioritise PAM where elevated access can interrupt care, restore services or reach patient data.
Practitioner guidance
- Map clinical identity dependencies Inventory which applications, devices, shared workstations and administrative paths can reach patient data or operational systems, then rank them by blast radius and recovery criticality.
- Separate privileged recovery access Use distinct privileged accounts for maintenance and emergency use, require stronger authentication, and log every elevated session to preserve accountability.
- Treat medical devices as governed identities Assign each connected device a defined access scope, review whether it really needs trust into clinical or administrative systems, and revoke inherited access where it does not.
Bottom line: Hospital cyberattacks in healthcare are increasingly an access-governance problem, not only a resilience problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:13 am
Healthcare identity governance has become a patient-safety control, not an IT sub-discipline. The article shows that hospital cyber risk now travels through access paths, not only infrastructure faults. When clinical operations depend on old systems, mobile devices and privileged logins, identity controls become part of care continuity. Practitioners should treat access governance as a clinical resilience issue, not a back-office function.
A question worth separating out:
Q: What governance questions should healthcare teams ask after a ransomware incident?
A: Teams should ask who could access critical systems, which accounts were overprivileged, whether devices inherited unnecessary trust, and how quickly elevated access can be revoked during recovery. Those questions expose whether the organisation has controlled the identity gap or merely documented it after the fact.
👉 Read our full editorial: Hospital cyberattacks expose the identity gap in healthcare security