Top 10 Healthcare Cyber Threats: What Hits Hospitals and How to Stop It

Healthcare organisations are attacked because downtime puts patients at risk, which makes them more likely to pay, and because patient records keep their value for years. This page ranks the ten threats that most often cause outages, data breaches and regulatory investigations at hospitals, clinics, payers and their suppliers, with a real incident or government advisory for each, what to detect and what to fix first. The ranking is an editorial judgement based on joint advisories from CISA, the FBI and the US Department of Health and Human Services (HHS), the HIPAA rules and the incidents in the NHI Mgmt Group breach database. It is written for healthcare security leads, IT and clinical engineering teams, and executives who need a short list to check their programme against. For who is behind these attacks, read the Threat Actors Targeting Healthcare Guide; for the obligations, the Healthcare Cyber Regulation Map.

The Top 10 at a glance

The order weighs how often each threat appears in advisories and breach reports against the harm to patients. A research hospital will move item 10 up; a small practice will find items 2, 4 and 5 cover most of its risk. Re-rank it against your own risk analysis, which the HIPAA Security Rule already requires at 45 CFR 164.308(a)(1).

1. Ransomware and data extortion

The threat: encryption of servers, hypervisors and backups (T1486 Data Encrypted for Impact) combined with theft of patient data for a leak site. The CISA, FBI and HHS advisory on ALPHV Blackcat (AA23-353A, updated February 2024) reported that healthcare had become the most commonly victimised sector among the group's leak site victims since mid-December 2023. Joint advisories on Rhysida (AA23-319A), Interlock (AA25-203A) and Medusa (AA25-071A) all name healthcare among frequent targets.

Why healthcare is exposed: clinical systems must stay up, many hospitals run lean IT teams, and electronic health records, imaging and laboratory systems depend on the same directory services that ransomware targets.

What to detect: backup deletion and shadow copy removal, new domain administrators (T1098 Account Manipulation), Kerberoasting attempts (T1558.003, described in the Interlock advisory), and bulk data copies to cloud storage before encryption.

How to fix: immutable and offline backups tested by restoring a clinical system end to end (NIST CSF 2.0 PR.DS-11), separate administrator accounts, tiered administration, and downtime procedures that clinical staff have practised. The HHS proposed update to the Security Rule (NPRM issued 27 December 2024) would require restoring relevant systems and data within 72 hours. See the Clinical Downtime and EHR Downtime Procedures Guide and the Recovering IAM and PAM After Ransomware or Domain Compromise guide.

2. Stolen credentials on remote access without MFA

The threat: a password bought from an infostealer log or an initial access broker, used on a VPN, Citrix or remote desktop portal that asks for nothing else (T1133 External Remote Services, T1078 Valid Accounts). In the Change Healthcare breach, attackers used a stolen credential on a Citrix remote access portal without MFA on 12 February 2024, deployed ALPHV ransomware about nine days later and disrupted claims and pharmacy payments across the US; the company's later update put affected people at 192.7 million. The Rhysida advisory also lists VPNs without MFA as an entry point.

What to detect: remote access logins from new countries or hosting providers, impossible travel, and accounts that sign in remotely for the first time.

How to fix: MFA on every external remote access service and every vendor support path, with no legacy exceptions (NIST SP 800-53 AC-17, IA-2). The HHS NPRM would make MFA a specific requirement rather than an addressable choice. See the Healthcare Identity Security Guide.

3. Exploited internet-facing and legacy systems

The threat: attackers exploit known vulnerabilities in remote access tools, file transfer servers and security appliances (T1190 Exploit Public-Facing Application). The Medusa advisory lists exploited vulnerabilities including ConnectWise ScreenConnect CVE-2024-1709 and Fortinet FortiClient EMS CVE-2023-48788, both in the CISA Known Exploited Vulnerabilities catalogue, and the Rhysida advisory notes exploitation of Zerologon.

Why healthcare is exposed: long equipment life cycles, clinical systems certified on old operating systems, and change freezes that delay patching.

What to detect: scanning and exploitation attempts against internet-facing services, new processes spawned by appliance services, and webshells.

How to fix: an external attack surface inventory, patching of KEV-listed vulnerabilities on internet-facing systems within days (RA-5, SI-2), and compensating controls (isolation, application allowlisting) for systems that cannot be patched. The HHS NPRM would require vulnerability scanning at least every six months and penetration testing every 12 months. See the Healthcare Delivery Organisation Cybersecurity Programme Guide.

4. Phishing and help desk social engineering

The threat: adversary-in-the-middle phishing that steals both password and session (T1557), and calls to the IT service desk asking for a password or MFA reset. The ALPHV advisory describes affiliates posing as IT or help desk staff to obtain credentials and using the Evilginx2 phishing framework to capture MFA sessions.

Why healthcare is exposed: clinicians work shifts across sites, frequently need urgent resets and are trained to be helpful. Help desks under pressure verify callers with details an attacker can find.

What to detect: MFA method changes shortly after a help desk ticket, sign-ins that reuse a session token from a new location, and mailbox rules created after a suspicious sign-in.

How to fix: phishing-resistant MFA for administrators and remote access, call-back verification for resets, and second approval for privileged accounts. See the Vishing and Help Desk Social Engineering Awareness Guide and the Help Desk Identity Verification Policy Template.

5. Business associate and supplier compromise

The threat: one clearinghouse, billing company, pathology provider or managed service provider is breached and every client loses a service or data (T1199 Trusted Relationship). Change Healthcare showed how a single supplier outage can stop claims and prescriptions nationally.

Why healthcare is exposed: heavy outsourcing of revenue cycle, laboratory, imaging and IT, with suppliers holding remote access into hospital networks.

What to detect: supplier remote sessions outside agreed windows, dormant vendor accounts becoming active, and data flows to suppliers that exceed the contract.

How to fix: business associate agreements with security and notification terms, vendor remote access through a brokered, recorded and MFA-protected path, and business continuity plans that assume a key supplier is down for weeks (SR-6, CP-2). The HHS NPRM would require business associates to verify their safeguards to covered entities at least annually. See the Third-Party Risk Management Guide.

6. Vulnerable medical devices and IoMT

The threat: infusion pumps, imaging modalities and monitoring systems running unsupported software, often on flat networks, used as a pivot point or disabled as collateral damage (T1210 Exploitation of Remote Services).

Why healthcare is exposed: devices stay in service for a decade or more, patches need manufacturer validation, and clinical engineering and IT security are often separate teams. In the US, section 524B of the Federal Food, Drug, and Cosmetic Act, effective 29 March 2023, requires manufacturers of cyber devices to provide a software bill of materials, a plan for monitoring and addressing postmarket vulnerabilities, and processes for updates and patches.

What to detect: devices talking to the internet or to unexpected internal hosts, new protocols on device VLANs, and logins to device management consoles.

How to fix: a complete device inventory (CM-8, ID.AM-01), network segmentation with allowlisted flows, MDS2 forms and SBOMs collected at procurement, and a process to triage manufacturer advisories. See the Medical Device Security Guide and the MDS2 and Medical Device SBOM Guide for Hospitals.

7. Insider snooping and misuse of EHR access

The threat: staff looking up records of celebrities, colleagues, family members or ex-partners, or copying records for sale (T1213 Data from Information Repositories). Verizon's 2026 Data Breach Investigations Report executive summary attributes 19% of healthcare breaches to internal actors, far above most other industries.

Why healthcare is exposed: broad "break-the-glass" access is needed for emergencies, so access controls are wide and misuse is found only by monitoring.

What to detect: record access with no care relationship, same-surname and VIP lookups, high-volume access by one user, and access to records of staff members. Audit controls are a HIPAA requirement under 45 CFR 164.312(b).

How to fix: automated privacy monitoring on EHR audit logs, prompt investigation with a published sanctions policy, and role-based access tuned by department (AC-3, AU-6). See the Top 10 Insider Threat Indicators and the Insider Threat Programme Guide.

8. Shared, generic and orphaned accounts

The threat: shared logins on ward workstations, generic accounts for devices and integrations, and accounts for locums, students and leavers that are never removed. Attackers use them because nobody notices their activity (T1078 Valid Accounts).

Why healthcare is exposed: speed of access matters at the bedside, staff rotate between sites and contracts, and interfaces between clinical systems run on service accounts with static passwords.

What to detect: logins to accounts of people who have left, generic accounts used interactively, and service accounts logging in from new hosts.

How to fix: fast user switching with badge tap so each clinician has a named session, joiner-mover-leaver automation from the HR and rostering systems (AC-2, IA-4), and an owner and rotation schedule for every service account. The HHS NPRM would require notifying other entities of access changes within 24 hours when workforce access ends. See the Joiner-Mover-Leaver Guide and, for the NHS, the NHS Spine, smartcards and NHS identity security guide.

9. Data exposure in cloud, email and web tools

The threat: patient data exposed without any intrusion: storage buckets left public (T1530 Data from Cloud Storage), emails sent to the wrong recipients, and tracking technologies on patient portals that send data to third parties.

Why healthcare is exposed: many small teams build portals and data exports, and each disclosure of unsecured protected health information can trigger HIPAA breach notification: individuals within 60 days, HHS within 60 days for breaches affecting 500 or more people, and the media where more than 500 residents of a state are affected.

What to detect: cloud storage with public access, data loss prevention alerts on outbound email containing patient identifiers, and third-party scripts on authenticated pages.

How to fix: block public cloud storage by policy, encrypt data at rest and in transit (a proposed requirement in the NPRM), review web trackers on portals, and use DLP on email. See the HIPAA Breach Notification Rule Guide and the Data Loss Prevention (DLP) Guide.

10. State-sponsored intrusion and espionage

The threat: state groups seeking research data and, in North Korea's case, money. The joint advisory AA24-207A on Andariel states that the group used ransomware against US healthcare organisations to fund its espionage activity, with medical organisations among its targets.

Why healthcare is exposed: research hospitals, pharmaceutical companies and universities hold clinical trial and genomic data, and often run open research networks.

What to detect: exploitation of internet-facing services followed by quiet reconnaissance, unusual access to research shares, and outbound transfers to unfamiliar infrastructure.

How to fix: segment research environments from clinical and corporate networks, apply the patching and MFA measures in items 2 and 3, and subscribe to sector threat intelligence through Health-ISAC or national CERT channels. See the AI Security in Healthcare Guide for research data used in AI models.

Detection and measurement

Metrics that show the programme is working:

• MFA coverage on remote access: share of external access paths, including vendor paths, that enforce MFA (target 100%).
• KEV patch time: median days to patch or mitigate KEV-listed vulnerabilities on internet-facing systems.
• Medical device inventory coverage: share of networked devices with owner, location, software version and segment recorded.
• Clinical system restore time: measured in the last exercise, against the 72 hours proposed by HHS.
• Leaver deprovisioning time: median hours from HR end date to account disablement.
• EHR privacy alert closure: share of privacy monitoring alerts investigated within the policy deadline.

Common failure patterns

• One remote portal left out of MFA: the Change Healthcare entry point; usually an old Citrix, VPN or vendor support portal kept for compatibility.
• Backups on the same domain: backup servers joined to the production domain, so domain admin rights allow attackers to delete them first.
• Downtime plans nobody has run: paper procedures exist but staff have never practised them, so a ransomware event becomes a patient safety event.
• Clinical engineering outside security: medical devices missing from the asset inventory and vulnerability process.
• Supplier risk as paperwork: business associate agreements signed but no technical control on supplier remote access and no plan for a supplier outage.
• Audit logs nobody reads: EHR access is logged as required but not monitored, so insider snooping is found only after a complaint.

Mapping to frameworks

The current Security Rule remains in effect while the HHS proposed rule is pending; the latest federal regulatory agenda lists the final action as a long-term item. See the HIPAA Security Rule Guide and the HHS HIPAA Security Rule Update (2025 NPRM) Guide.

Where to start

1. First 30 days: find every external remote access path, including vendor portals, and enforce MFA; check that at least one backup copy is immutable or offline and outside the production domain.
2. Days 30 to 90: patch or isolate KEV-listed internet-facing systems, tighten help desk reset verification, and disable accounts of leavers found in an HR reconciliation.
3. Days 90 to 180: segment medical devices, start EHR privacy monitoring, broker all supplier remote access, and run a downtime exercise with clinical staff that includes restoring an EHR-dependent service.
4. Ongoing: refresh the HIPAA risk analysis each year with this list and current HHS and CISA advisories, and re-rank it.

Small practices should start with items 2, 4 and 5 and the backup check: see the Cyber Security for Dental and GP Practices Guide. Large health systems usually have controls for all ten; their gaps are coverage (acquired hospitals, research networks, device fleets) and recovery speed.

Practitioner checklist

• Every external remote access path, including vendor support portals, enforces MFA.
• At least one backup copy is immutable or offline, and a clinical system restore has been tested.
• KEV-listed vulnerabilities on internet-facing systems are patched or mitigated within days.
• Help desk resets use call-back or in-person verification, with a second approver for privileged accounts.
• Supplier remote access is brokered, recorded and time-limited.
• Medical devices are inventoried and segmented, with SBOMs collected at procurement.
• EHR audit logs are monitored for access without a care relationship.
• Leavers, locums and students are deprovisioned from HR and rostering data automatically.
• Clinical staff have practised downtime procedures within the last year.

Standards and references

• CISA, FBI and HHS: ALPHV Blackcat advisory AA23-353A
• CISA: Rhysida Ransomware advisory AA23-319A
• CISA, FBI and HHS: Medusa Ransomware advisory AA25-071A
• FBI and partners: North Korea Cyber Group Conducts Global Espionage Campaign (AA24-207A)
• eCFR: 45 CFR Part 164 Subpart C, HIPAA Security Rule
• HHS: HIPAA Security Rule NPRM Fact Sheet
• HHS: Breach Notification Rule
• FDA: Cybersecurity in Medical Devices

Related NHI Mgmt Group resources: Threat Actors Targeting Healthcare Guide · Healthcare Identity Security Guide · Healthcare Cyber Regulation Map · Medical Device Security Guide · Top 10 Financial Services Cyber Threats