Healthcare — Cyber Threat Activity
Threat actors, incidents and malware targeting the Healthcare sector — 2,135 recorded incidents and 169 tracked groups.
- Recorded incidents: 2,135
- Incidents, trailing 180 days: 590
- Tracked threat actors: 169
- Malware families: 187
Recent incidents
- Primary Eye Care 2026-08-06
- Magnolia Dental 2026-08-06
- Country Oaks Veterinary Clinic 2026-08-06
- Ferrell \ Skyline Implants & Periodontics \ Dr. Scott Ferguson 2026-08-06
- PT All Cosmos Biotek 2026-08-05
- Ohio Living Home Health & Hospice 2026-08-05
- Labpharma 2026-08-05
- The Family Medicine Clinic 2026-08-05
- Mansfield Family Dentistry 2026-08-05
- Mile Bluff Medical Center 2026-08-05
- hetero.com 2026-08-05
- clintonhealthaccess.org 2026-08-04
- Cardiology Associates 2026-08-04
- healthcarehighways.com 2026-08-04
- ADG Healthcare 2026-08-04
- Texas Medical Screening 2026-08-04
- Wisdom Oral Surgery 2026-08-04
- BLACKBURN'S 2026-08-03
- Cameron Regional Medical Center 2026-08-03
- Alcon Inc. 2026-08-02
Threat actors targeting Healthcare
- Qilin 169 incidents
- INC Ransom 118 incidents
- RansomHub 80 incidents
- LockBit 78 incidents
- Medusa Ransomware 44 incidents
- The Gentlemen 42 incidents
- KillSec 41 incidents
- BianLian 41 incidents
- Akira 40 incidents
- DragonForce 38 incidents
- Rhysida 37 incidents
- SafePay 36 incidents
- Hunters International 26 incidents
- BlackSuit 22 incidents
- Cl0p 21 incidents
- NightSpire 21 incidents
- Lynx Ransomware 15 incidents
- CRPxO 13 incidents
- Black Basta 12 incidents
- RansomHouse 12 incidents
- ALPHV/BlackCat 11 incidents
- Meow 11 incidents
- 8Base 10 incidents
- Anubis 10 incidents
Where these victims are
- United States 1,639
- India 41
- United Kingdom 34
- Canada 33
- Australia 29
- Germany 26
- Brazil 16
- France 16
- Spain 15
- Mexico 14
- Argentina 12
- Italy 11
Malware used against Healthcare
Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.
- Agent Tesla Malware
- Akira Malware
- Black Basta Malware
- Clop Malware
- Cobalt Strike Malware
- Conti Malware
- Emotet Malware
- Impacket Tool
- Mimikatz Tool
- PlugX Malware
- PsExec Tool
- QakBot Malware
Coverage. 76.7% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.