Healthcare Under Ransomware: When Downtime Is a Patient-Safety Event

Hospitals combine time-critical care, legacy and medical-IoT devices that cannot be patched or taken offline, large stores of monetisable health data, and strong pressure to restore operations quickly — which raises the odds of a ransom payment. Attackers pursue extortion leverage (encryption plus data-theft “double extortion”) and the fraud value of health records. Downtime is a patient-safety event: electronic-health-record outages, ambulance diversion and delayed procedures. Concentration risk is acute — a single clearinghouse or vendor compromise can cascade nationally, as the Change Healthcare incident showed.

Why Healthcare Is Targeted

The sector pairs life-safety urgency with weak patchability and valuable data. Common intrusion chains use phishing (T1566), exploitation of public-facing apps and remote tools (T1190), and valid accounts or external remote services without MFA (T1078 T1133), followed by data exfiltration (T1567) and encryption for impact (T1486).

Defining Incidents

• Change Healthcare / UnitedHealth (from February 2024): a massive U.S. pharmacy and claims disruption. Optum attributed it to actors claiming to be ALPHV/BlackCat, followed by a separate affiliate extortion after an apparent exit scam. CEO Andrew Witty testified in May 2024 that the company paid a US$22M ransom and that initial access used a stolen credential on a Citrix portal lacking MFA. Reported impact figures range from roughly 100 million (HHS) to about 190 million individuals (UnitedHealth, via press) — company and press figures that were still being finalised.
• Ascension (May 2024): ransomware forced EHR downtime and emergency-department diversion across a large multi-state system; press reporting attributed it to Black Basta via unnamed sources (not an official Ascension statement). Ascension notified roughly 5.6 million people of a related breach.
• Interlock (emerged late 2024): a July 2025 FBI/CISA/HHS/MS-ISAC joint advisory warned of double-extortion campaigns hitting healthcare; Kettering Health was a documented 2025 victim.

Active Groups

ALPHV/BlackCat and affiliates, Black Basta (a possible Conti offshoot), Interlock and RansomHub feature prominently. Reporting notes abuse of remote-support software (such as ScreenConnect), living-off-the-land tradecraft, and double extortion. Treat specific indicators as unconfirmed unless sourced.

Defensive Priorities

• Enforce phishing-resistant MFA on all remote access (VPN, Citrix, RDP, remote-support tools) — the Change Healthcare root cause.
• Inventory and tier third parties and clearinghouses; require breach-notification SLAs and test failover to alternate claims/pharmacy routing.
• Maintain offline, tested backups and documented EHR-downtime clinical procedures, and exercise them; segment clinical and medical-device networks from IT and admin domains.
• Patch or retire internet-exposed remote-access and management software promptly; monitor for data staging and exfiltration, not just encryption; join Health-ISAC and action CISA/HHS advisories.