Healthcare ransomware: Risks, major incidents and how to protect your practice

Healthcare ransomware is malicious software that encrypts a provider’s critical systems, holds patient records hostage, and demands payment before restoring access.

According to the Sophos State of Ransomware in Healthcare 2024 survey, 67% of healthcare organizations were hit by ransomware in the past year. That rate is a four-year high.

The damage reaches well beyond IT. Canceled surgeries, diverted ambulances and breach notifications can follow within hours of an attack. For most practices, the controls with the highest return are multi-factor authentication on remote access, offline backups and network segmentation. This guide covers why healthcare is such an attractive target, how an attack unfolds stage by stage, and how to put those controls in place.

Key takeaways

Healthcare ransomware encrypts clinical systems and patient records at once, creating a patient safety crisis and a HIPAA breach in a single incident.

The 2024 Change Healthcare attack disrupted claims processing for thousands of US providers, and UnitedHealth Group confirmed paying a ransom to ALPHV/BlackCat.

HHS guidance treats a ransomware attack as a presumed HIPAA breach unless proven otherwise, which starts a 60-day clock for notifying affected individuals.

Offline backups, multi-factor authentication and network segmentation are the three controls with the highest return for large health systems and small private practices alike.

Healthcare ransomware: Why the sector is a prime target

Healthcare ransomware attacks succeed because healthcare organizations can’t afford downtime. A law firm can function for 48 hours without its file system. A hospital caring for a ventilated patient cannot. That asymmetry gives attackers enormous leverage, and they know it.

Several structural factors compound the problem. Electronic health records hold insurance identifiers, Social Security numbers and clinical histories, so they sell for far more than a stolen credit card. Healthcare organizations also run a higher proportion of legacy systems than other critical sectors. Part of the reason is that replacing an FDA-cleared medical device requires regulatory validation, not just a software update.

• 24/7 uptime pressure: Clinical systems must stay online around the clock. Attackers count on the hesitation between “we need to investigate” and “we can’t take the system offline.”
• Large attack surface: A mid-size hospital connects medical devices, EHR systems, billing platforms, lab equipment and third-party vendor portals into a single network.
• Credential sprawl: High staff turnover in healthcare leaves dormant accounts and weak password hygiene across dozens of systems.
• Third-party dependency: Claims clearinghouses, lab networks and imaging vendors all become potential entry points into a provider’s environment.

Smaller practices face a version of the same problem without an enterprise security budget. A med spa or a solo private practice often relies on the same cloud tools as a large health system. Yet it has no dedicated security team watching for threats.

The scale of the problem: Healthcare ransomware statistics

Organized criminal groups now single out healthcare on purpose, and the figures below show how often they succeed.

The recovery cost is the figure practice managers should watch most closely. Ransomware carries costs that rarely make headlines:

• IT contractor fees
• Forensic investigators
• Temporary staffing to cover manual procedures
• Regulatory counsel
• Revenue lost from canceled appointments and diverted patients

Notable healthcare ransomware incidents: Change Healthcare and WannaCry

Two incidents define the modern healthcare ransomware landscape. One exposed the fragility of the US billing infrastructure. The other showed how fast a single unpatched vulnerability can cascade across a national health system.

Change Healthcare: The 2024 attack that paralyzed US billing

The February 2024 Change Healthcare attack is the largest healthcare ransomware event in US history by scope. The ALPHV/BlackCat group got in through a compromised Citrix remote access portal that lacked multi-factor authentication. It encrypted systems across Change Healthcare’s network and stole data on an estimated 190 million people, per HHS OCR (2025).

Andrew Witty, CEO of parent company UnitedHealth Group, confirmed the ransom payment in congressional testimony, a sum widely reported at about $22 million. Despite the payment, a second group, RansomHub, later tried to extort the company again and posted samples of the stolen data.

The downstream effects on providers were severe. Pharmacies couldn’t process prescriptions, and hospitals couldn’t submit claims. In an informal American Medical Association survey from April 2024, 80% of responding practices had lost revenue from unpaid claims. More than half had used personal funds to cover practice expenses.

WannaCry and the NHS: What 2017 taught healthcare about patching

WannaCry hit the NHS in May 2017 by exploiting EternalBlue, a vulnerability in Windows SMB that Microsoft had patched two months earlier. NHS trusts running unpatched Windows 7 systems were locked out of patient records within hours. The UK National Audit Office documented about 19,000 canceled appointments, and five NHS trusts diverted ambulances.

Patching faster matters, but WannaCry exposed a harder problem. Legacy medical systems create an unpatchable surface that security teams can’t always touch. An MRI scanner certified on Windows XP often can’t be upgraded without the manufacturer revalidating it. Security planning has to account for devices that will never receive patches, and build compensating controls around them.

How a ransomware attack on a healthcare system unfolds

Ransomware campaigns against healthcare organizations follow a consistent kill chain. Knowing each stage shows defenders where they have the best chance to intervene.

1. Initial access: Phishing, exposed RDP and VPN, and unpatched internet-facing software are the most common entry points, according to CISA ransomware guidance. RDP is the Remote Desktop Protocol staff use to reach office machines from elsewhere.
2. Persistence and lateral movement: Once inside, the attacker deploys tools to move across the network and escalate privileges. Then it hunts for high-value systems such as EHR databases, backup servers and billing platforms.
3. Data exfiltration: Modern ransomware groups copy patient records out before encrypting them. That creates the double-extortion dynamic, where the attacker threatens to publish the data whether or not you restore from backup.
4. Encryption: The ransomware payload encrypts files across every system it can reach. Healthcare-targeted variants often go after the database file types that common EHR platforms use.
5. Ransom demand: The attacker demands payment, typically in cryptocurrency, behind a countdown timer. The note warns that unpaid ransoms lead to public data release.

Speed matters as much as sequence. Sophos incident data puts the typical ransomware dwell time at several days, so detection has to happen early in the chain. Each stage is also a point where one specific control can stop or blunt the attack, as the diagram below maps out.

The dual impact: Patient safety risk and data privacy risk

Healthcare ransomware is a category of attack that creates a patient safety crisis and a data privacy breach in the same incident. The two risks feed each other, so clinical operations, compliance and IT have to respond together.

How ransomware disrupts clinical operations

When EHR systems go offline, clinical staff fall back on paper-based downtime procedures. Medication orders are handwritten, and lab results stop arriving electronically. Radiology images become inaccessible, and pharmacy dispensing slows to manual checks. Each bottleneck opens a chance for a clinical error that wouldn’t happen in a working digital environment.

The spillover effect gets less attention than it deserves. When one hospital in a region diverts ambulances after an attack, neighboring emergency departments absorb the extra patients. A hospital that was never attacked still faces more pressure, less capacity and higher risk for the patients it takes in. Peer-reviewed research has documented this spillover in facilities next to an attacked hospital.

HIPAA obligations when ransomware strikes

The HHS Office for Civil Rights ransomware guidance from 2016 says a ransomware attack is presumed to be a HIPAA breach. The covered entity or business associate can rebut that only by showing a low probability that protected health information (PHI) was compromised. Most attacks can’t clear that bar, especially when data was exfiltrated.

The HIPAA Breach Notification Rule then requires notice to affected individuals within 60 days of discovering the breach, plus notice to HHS. A breach affecting 500 or more residents of a state also requires notice to prominent media outlets there. OCR investigations can follow, and HIPAA violation penalties for willful neglect reach into the millions.

Most of the technical safeguards that reduce this exposure sit in the HIPAA Security Rule. Our guide to EHR security covers the safeguards that protect patient records day to day.

Healthcare ransomware prevention: Controls that reduce risk

Prevention works in layers. The controls below make initial access harder, limit how far an attacker moves once inside, and keep recovery possible without paying a ransom. They apply to health systems and small private practices alike, though implementation varies with size and budget.

• Multi-factor authentication (MFA) on every remote access point: The Change Healthcare attack entered through a portal without MFA. MFA on VPN, RDP and admin accounts closes the most common entry vector.
• Offline, air-gapped backups: Ransomware groups target backup systems to block recovery. Backups that can’t be reached from the primary network survive an encryption event. Test restoration at least quarterly.
• Network segmentation: Separating clinical systems from administrative systems, and both from internet-facing applications, limits how far an attacker can move after initial access. A breached clinical device shouldn’t automatically become an EHR breach.
• Patch management cadence: WannaCry exploited a vulnerability Microsoft had already patched. Systems that can’t be patched, such as certified medical devices, need compensating controls like network isolation and closer monitoring.
• Phishing-resistant staff training: Many healthcare ransomware attacks start with a staff member clicking a link. Simulated phishing programs that test and train staff reduce this risk, and they’re recommended in the HHS 405(d) Health Industry Cybersecurity Practices.
• Vendor risk assessment: Any third party with access to your systems or patient data is a potential entry point. Require business associate agreements that include incident response commitments and security certifications.

Smaller practices on cloud-based practice management platforms inherit some of these controls from their vendor. A vendor’s encryption, backup and access controls can shrink the attack surface without dedicated IT staff. Ask every vendor one question. Do you have documented incident response procedures, and how fast will you notify us if your platform is compromised?

What smaller practices should prioritize first

The enterprise controls above can feel like a lot for a solo aesthetic practitioner or a two-physician practice. The practical starting point looks different from a 500-bed hospital’s security roadmap.

• Enable MFA on your email, your practice management platform and any cloud storage. On most platforms, the only cost is setup time.
• Confirm your software vendor runs automated, encrypted backups with a defined recovery time objective. Ask specifically whether backups are isolated from production systems.
• Run a one-hour staff walkthrough on recognizing phishing emails, and build it into your HIPAA training for employees. Focus on credential-harvesting patterns such as unexpected login prompts, invoice attachments and password-reset emails from unfamiliar senders.
• Complete a HIPAA risk assessment, and confirm your software vendor will sign a Business Associate Agreement.

How practice management and EHR vendors should protect your data

Your software vendor’s security posture is part of your own risk profile. When you evaluate or review a practice management platform, ask for documentation on these four points:

• Data encryption at rest and in transit: Patient records should be encrypted to current standards. That covers storage and every transfer between your devices and the vendor’s servers.
• Backup SLA and isolation architecture: How often are backups taken? Are they isolated from the production environment? What is the guaranteed recovery time?
• SOC 2 or equivalent audit: An independent audit confirms the vendor’s security controls are not self-reported.
• Incident notification commitment: If the vendor’s platform is compromised, how quickly will they notify you, and what support will they provide during the response?

Ransomware recovery in healthcare: Containment, decision, and restoration

Ransomware recovery in healthcare runs three jobs at once: clinical continuity, regulatory notification and a forensic investigation. Restoring IT systems is only one part of it.

1. Contain and isolate: Disconnect affected systems from the network immediately. Don’t attempt to decrypt or investigate on live systems. Preserve forensic evidence by capturing disk images before rebooting any machine.
2. Notify law enforcement: Contact the FBI’s Internet Crime Complaint Center (IC3) and your local FBI field office. The FBI may already hold intelligence on the threat actor group involved.
3. Activate clinical downtime procedures: Every clinical area should have documented manual downtime protocols. If they don’t exist, this incident is the trigger to build them. Patient safety can’t pause while IT works on recovery.
4. Assess breach scope: Determine whether data was exfiltrated before encryption, because that drives the HIPAA notification obligation. Engage a qualified forensic firm. Self-assessment is rarely sufficient for regulatory purposes.
5. Ransom payment decision: The FBI and CISA both advise against paying ransoms. Payment doesn’t guarantee data recovery, and it funds future attacks. It may also expose the organization to OFAC sanctions risk if the threat actor group is on a sanctions list. Organizations considering payment should consult legal counsel first.
6. Restore from clean backups: Validate backup integrity before restoration. Confirm the restored environment is free of persistence mechanisms before bringing clinical systems back online.
7. Post-incident review: Hold a structured review within 30 days. Identify the initial access vector, the dwell time before detection, and the weak controls that allowed lateral movement. Update the incident response plan to match.

HIPAA notification obligations that follow a confirmed breach run on their own timeline alongside the technical recovery. Notices to OCR, affected individuals and, where required, the media all have fixed deadlines that don’t pause for system restoration.

How Pabau keeps patient records recoverable after a ransomware attack

Many small practices still keep patient records on an office server or a shared drive, backed up when someone remembers. If ransomware encrypts that machine, the backup may be encrypted with it, and the schedule stays dark until the files come back.

Pabau, the cloud practice management platform we build for private practices and med spas, keeps those records off your premises. Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Daily backups are stored in multiple locations and kept for six months.

Hosting runs on DigitalOcean infrastructure that is SOC 2 Type II certified, and Pabau undergoes independent penetration testing at least annually. Pabau publishes these commitments on its security page.

Inside the platform, access permissions, audit logs and Pabau’s compliance management tools keep the documentation an internal audit or OCR investigation asks for. A compromised office computer then holds neither your only copy of patient records nor your compliance trail.

Keep patient records safe from ransomware

Pabau stores patient records encrypted in the cloud, with daily backups kept in multiple locations, so an infected office computer never holds your only copy. Book a demo to see how it works for your practice.

Book a demo

Conclusion

Healthcare ransomware is a major threat to clinical continuity, and an unmanaged incident can cost far more than prevention.

Start with the three controls that cover the most ground. Those are MFA on every remote access point, backups isolated from your network, and a response plan your team has rehearsed. None of them needs a security department. With all three in place, an attack becomes a recovery job with a known playbook.

Then turn to your vendors, because Change Healthcare proved a clearinghouse can halt your billing without touching your network. Ask each one for its backup, notification and incident response commitments, and choose HIPAA compliance software that puts them in writing. Book a demo to see how Pabau protects patient records and keeps your practice running if an attack hits.

Continue your research

Looking to understand your practice’s compliance obligations? HIPAA compliance for medical offices covers the administrative and technical safeguards the Security Rule requires of every covered entity.

Worried a breach could become a violation? What to do if you violate HIPAA walks through the steps to take once a breach is confirmed.

Is your inbox the weak point? HIPAA-compliant email explains how to send patient information without exposing it.

Ready to check your own safeguards? HIPAA audit checklist gives you a template to review your practice’s controls item by item.

Frequently asked questions