Healthcare — Cyber Threat Activity

Healthcare is the sector where cyber attacks translate most directly into physical harm, and it carries more than 2,100 recorded incidents across 77 countries in our log. Over 630 fall in the trailing 180 days and 90 distinct groups have been attributed at least one claim, led by Qilin (170), INC Ransom (119), RansomHub (80), LockBit (78) and The Gentlemen (48). CISA, FBI and HHS have warned since 2020 that criminal crews deliberately target hospitals with loader-to-ransomware chains, accepting that the consequence is diverted ambulances, delayed procedures and clinicians reverting to paper. The economics are brutal and well understood by the attackers: a hospital cannot suspend operations to rebuild, holds decades of irreplaceable records, and faces regulatory exposure on disclosure, so it is squeezed from three directions at once. Our records reach back to 2010, earlier than most sectors here, because healthcare incidents arrive through public breach notification regimes as well as leak-site claims, which also explains why the United States accounts for 1,688 of them; that is a reporting-law artefact, not evidence that American hospitals are uniquely targeted. India, Canada, the United Kingdom, Australia and Germany follow. Medical devices and imaging systems deepen the problem, since certified equipment often cannot be patched on any normal cycle and sits on the same network as everything else. Treat the totals as claims rather than confirmed breaches, and note that the sector's real exposure runs wider than the count: third-party billing, transcription and diagnostics providers concentrate patient data far beyond the walls of any one hospital, and a single supplier compromise routinely surfaces later as dozens of separate provider notifications.

All sectors

Recent incidents

Threat actors targeting Healthcare

Where these victims are

Malware used against Healthcare

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Coverage. 92.8% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions