On the night of 21 February 2024, Change Healthcare — a subsidiary of UnitedHealth Group processing approximately one-third of all US medical claims — suffered a ransomware attack that took its systems offline for weeks. Pharmacy claims processing halted across much of the country. Hospitals and provider practices could not verify insurance coverage or receive payments for services. UnitedHealth Group ultimately paid the attackers $22 million in ransom, and even that payment did not prevent the theft and eventual release of protected health information for approximately one-third of the American population. The Change Healthcare attack was the largest healthcare cybersecurity incident in American history and demonstrated with painful clarity that the healthcare sector had reached a cybersecurity crisis point.
The Change Healthcare incident was not an isolated event. It was the most visible manifestation of a systematic pattern: ransomware attacks against US healthcare organisations exceeded 500 successful incidents in 2024, up from approximately 300 in 2020 and roughly 100 in 2016. The attacks have grown in frequency, sophistication, and impact simultaneously. The healthcare sector has become the most consistently targeted category of critical infrastructure in the ransomware economy, and the trajectory over the next two years will define which organisations retain viability.
Why Healthcare Has Become the Preferred Target
Several structural factors have combined to make healthcare organisations attractive targets for ransomware attackers. First, healthcare operations cannot tolerate extended downtime in ways that many other industries can. When a manufacturer’s IT systems go down, production halts and revenue is lost, but people generally do not die. When a hospital’s IT systems go down, patient care becomes dangerous. Emergency rooms cannot receive ambulances. Surgeries must be postponed. Medications cannot be verified against records. Clinical decisions must be made without complete patient histories. The urgency of restoring operations creates powerful incentive to pay ransoms quickly, which attackers recognise and exploit.
Second, healthcare organisations have historically underinvested in cybersecurity relative to their risk exposure. The average healthcare organisation spends approximately 6% of its IT budget on cybersecurity, compared with 12 to 15% in financial services and 10 to 12% in energy infrastructure. The underinvestment reflects several factors: healthcare margins have been thin, capital investment priorities have focused on clinical technology and revenue-generating systems, and the historical view of healthcare as a low-target industry proved dangerously wrong. The gap between the risk healthcare organisations face and the security investment they have made has become the primary vulnerability that attackers exploit.
Third, the healthcare IT environment is uniquely complex. A large hospital system may operate hundreds of clinical applications, thousands of connected medical devices, and IT infrastructure that spans acquired facilities with heterogeneous legacy systems. Many medical devices in current clinical use run on outdated operating systems that cannot be patched for security vulnerabilities without risking clinical function. Electronic health record systems, imaging systems, and specialty clinical applications create a massive attack surface that is exceptionally difficult to secure completely.
Fourth, protected health information has commercial value on data markets that has grown substantially. Medical records sell for significantly higher prices than credit card information because the underlying data can be used for insurance fraud, prescription fraud, identity theft, and blackmail in ways that financial data cannot. Attackers who successfully exfiltrate healthcare data have multiple monetisation pathways beyond ransom payment, which changes the economics of the attack decision.
The Patient Safety Dimension
The most sobering aspect of healthcare cybersecurity attacks is their documented impact on patient care outcomes. Research published in JAMA and other peer-reviewed medical journals has established that ransomware attacks against hospitals are associated with measurable increases in patient mortality. A 2023 study of hospitals affected by ransomware attacks found approximately 20% increases in in-hospital mortality during and immediately after attacks, driven by delays in clinical decision-making, diverted ambulance traffic, postponed procedures, and disrupted care coordination.
The patient safety impact extends beyond the immediate victim organisations. When a major hospital in a regional health system is attacked, patients divert to neighbouring facilities. Emergency departments face capacity strains that affect care quality for all patients, not just those originally scheduled at the attacked facility. Specialty services that require coordinated infrastructure across multiple facilities may be disrupted regionally. The systemic patient safety impact of major healthcare cybersecurity attacks makes them different from most other categories of business cyber incidents.
The medico-legal dimension has become significant. Hospitals have faced litigation from patients and families claiming harm resulting from ransomware attack disruptions. Insurers have begun to restrict coverage or increase premiums for healthcare organisations without demonstrated cybersecurity capabilities. Regulatory bodies including the Department of Health and Human Services Office for Civil Rights have imposed substantial fines on organisations found to have inadequate security practices at the time of successful attacks.
The Attacker Ecosystem
The ransomware attacker ecosystem has professionalised substantially over the past five years. What began as opportunistic attacks by relatively unsophisticated criminal groups has evolved into an industry with specialised roles, service providers, and business models. Ransomware-as-a-service platforms including AlphV/Blackcat (allegedly disrupted in 2024 but with successor operations continuing), LockBit, and Cl0p provide the technical infrastructure that individual attackers use to conduct campaigns. Initial access brokers specialise in obtaining and selling network access to targeted organisations. Money laundering services facilitate the conversion of cryptocurrency ransom payments into usable currency.
The geographic origin of major ransomware operations has been concentrated in Russia and other Eastern European jurisdictions where local law enforcement provides limited cooperation with Western investigations. This geographic concentration has been a persistent challenge for cybersecurity defence and has produced sustained international policy attention. Recent US government actions including sanctions against specific ransomware operators, disruptions of ransomware infrastructure, and public disclosures of ransomware operator identities have imposed costs on attackers but have not fundamentally changed the operational environment.
The attacker sophistication has grown alongside the ecosystem’s professionalisation. Modern ransomware attacks typically involve extended reconnaissance periods during which attackers map target networks, identify high-value data and systems, and position themselves for maximum leverage before triggering the actual encryption phase. The average time between initial network compromise and ransomware deployment now exceeds three weeks, providing extended windows during which attacks could theoretically be detected but often are not.
The Board-Level Response That Is Required
For hospital boards and healthcare executive teams, cybersecurity has moved from an IT operational issue to a fundamental strategic and fiduciary responsibility. Regulatory guidance from the Department of Health and Human Services, guidance from the American Hospital Association, and the general legal environment now expect boards to actively engage with cybersecurity risk management, not merely to receive periodic informational updates.
The specific board-level responsibilities include ensuring adequate cybersecurity investment relative to organisational risk profile, verifying that appropriate governance structures exist for cybersecurity decision-making, engaging with cyber insurance underwriting requirements, understanding organisational incident response capabilities, and receiving credible reports on cybersecurity programme performance. Boards that receive purely technical reports without translation into strategic and risk terms are not fulfilling their governance responsibility. Boards that receive only reassurance without genuine engagement with cybersecurity risk are exposing the organisation and themselves to unacceptable liability.
Cybersecurity investment for major healthcare organisations should approach 10 to 12% of IT budget in current conditions. The historical 6% figure is inadequate given the risk environment. The specific investment priorities should focus on multi-factor authentication universally deployed, endpoint detection and response capabilities, robust backup systems that are isolated from primary networks, incident response planning that has been actually exercised, and third-party risk management given the critical dependencies healthcare organisations have on IT service providers.
The Third-Party Risk Question
The Change Healthcare attack demonstrated with particular clarity that healthcare cybersecurity risk extends beyond individual organisational security to include the substantial third-party ecosystem that healthcare operations depend on. Electronic health record vendors, medical device manufacturers, revenue cycle management providers, laboratory information systems, imaging systems, and hundreds of other specialised software providers all represent potential vectors for cybersecurity risk.
Managing third-party risk in healthcare requires comprehensive vendor risk assessment programmes, contractual requirements for cybersecurity practices among vendors, ongoing monitoring of vendor security posture, and business continuity planning that anticipates potential vendor disruptions. The operational complexity of these programmes is substantial, and most healthcare organisations have not yet developed the capabilities they require.
What the Next Two Years Will Look Like
The trajectory for the next two years is toward continued growth in both attack frequency and defensive investment. Attack frequency is likely to grow because the underlying economics remain favourable for attackers and no fundamental disruption of the attacker ecosystem appears imminent. Defensive investment is growing because the alternative — continued attacks with worsening consequences — has become unacceptable to boards, insurers, and regulators.
Regulatory attention will continue to intensify. The Cyber Incident Reporting for Critical Infrastructure Act will require expanded cybersecurity incident reporting beginning in 2026. The Department of Health and Human Services has proposed new cybersecurity performance requirements as conditions of Medicare and Medicaid participation. State-level cybersecurity requirements for healthcare organisations are proliferating and adding complexity to compliance obligations.
The insurance market for healthcare cybersecurity will continue to tighten. Cyber insurance premiums for healthcare organisations have increased dramatically over the past three years, and coverage has become more restrictive. Some organisations with weak security posture have found themselves effectively uninsurable, forcing them to either invest substantially in security improvements or operate with unhedged risk that boards find unacceptable.
For healthcare executives, the path forward requires treating cybersecurity as a strategic capability rather than an IT overhead cost. Organisations that build genuine cybersecurity resilience — through appropriate investment, effective governance, and cultural integration of security into operational thinking — will be positioned to continue their mission of patient care through the ongoing threat environment. Organisations that do not may find that the next successful attack against them is the one they do not survive as viable operating entities. The stakes have become that high.
