Part 1: Healthcare in the Crosshairs
Healthcare in the Crosshairs: Part 1 of the Healthcare Under Siege Series
Why Cybercriminals Target Healthcare
190 million patient records. One vendor breach. And one of the largest healthcare providers in the United States brought to its knees.
That was February 2024. The Change Healthcare ransomware attack became the largest healthcare data breach in U.S. history and one of the most disruptive events the industry has ever seen. Pharmacies, hospitals, and billing systems across the country ground to a halt.
And it was not an outlier.
Every week, attackers are targeting hospitals, clinics, insurers, and research institutions. Not by chance, but by design. Healthcare is not just a target of opportunity. It is the target.
The motivations vary from profit to espionage to disruption, but the direction is clear. Healthcare organizations hold some of the most valuable, sensitive, and exploitable data in existence. At the same time, many operate with aging infrastructure, complex vendor ecosystems, and systems without built-in redundancy.
Understanding why this industry is being targeted is the first step toward protecting it.
- Protected Health Information (PHI) Is the Most Valuable Data You Own
Healthcare data is among the most valuable assets in the criminal economy. Unlike credit card numbers that can be canceled with a phone call, Protected Health Information (PHI) contains permanent, deeply personal details—diagnoses, prescription history, social security numbers, contact information, and even family data. It is a comprehensive profile that can’t be replaced or reset.
That permanence makes it incredibly profitable. According to the American Hospital Association, a single stolen health record can sell for as much as $1,000 through criminal resale channels, compared to $5–110 for a stolen credit card. With over 259 million records breached in healthcare last year alone, this method of theft is clearly thriving.
But it’s not just resale value. Healthcare data fuels a range of profitable crimes:
- Insurance fraud through false claims and billing.
- Prescription abuse using legitimate identities.
- Tax fraud and new account openings with stolen Social Security numbers.
- Blackmail and extortion, particularly when mental health or sensitive diagnosis data is involved.
And because healthcare systems often operate across multiple providers, labs, insurers, and care teams, that data moves frequently. Every handoff is an opportunity—unless the infrastructure is designed to keep it contained, visible, and protected.
- The Stakes Are Life-or-Death
Healthcare systems are expected to run continuously, without pause. When they stop—even briefly—patients wait, prescriptions stall, surgeries are rescheduled, and lives hang in the balance. That pressure makes hospitals and health systems high-leverage targets for ransomware and extortion. It also makes them more likely to pay.
Attackers understand that healthcare carries a unique combination of critical operations, public visibility, and limited tolerance for downtime. The 2025 Verizon Data Breach Investigations Report notes that ransomware attacks like the one on Change Healthcare cause widespread outages across hospitals, pharmacies, and billing. These events triggered not only data loss but significant business interruption, often more damaging than the breach itself.
When systems go down, organizations scramble to maintain continuity.
- Paper processes return.
- Patients wait and lose confidence.
- Providers are forced to balance operational disruption, patient safety, and public scrutiny.
And ransomware groups continue to evolve. They’ve learned to exfiltrate data before encryption, leak it gradually, and apply pressure to leadership with each passing hour. Some time their attacks around holidays or major clinical periods to increase impact.
Healthcare leaders are left managing the fallout while working behind the scenes to restore access and protect patients. But if they have the right network architecture, controls, and partnerships they contain the catastrophe even under pressure.
- Espionage Is Not Theoretical
Not all attacks on healthcare are financially motivated. Some are strategic.
In 2024, espionage-motivated breaches in healthcare increased from 5 to 12 percent, according to the Verizon Data Breach Investigations Report. What was once a low-level threat is now a clear trend. Foreign actors are no longer just probing infrastructure; they are actively collecting data.
Medical records reveal more than diagnoses. They expose occupations, identities, locations, and vulnerabilities. That makes them useful to state-sponsored threat groups seeking intelligence, not just money.
These actors are patient. They exploit misconfigurations, abuse trusted access, and quietly extract data over time. Often, they do it through third-party vendors that may not even realize they’ve been compromised.
With espionage in mind, it is now more important than ever to start designing environments that are harder to map, harder to move through, and far less useful to attackers.
The Unspoken Reason It Keeps Happening
Knowing how vital this threat is, the next logical question is: Why does it keep happening?
The answer: we’re applying Band-Aids without cleaning the wound.
Healthcare organizations continue to invest in endpoint protection, employee training, and threat monitoring, and those are all critical pieces of a strong cybersecurity posture. But in breach after breach, attackers aren’t getting in because tools have failed. They’re succeeding because once they’re in, there’s nothing stopping them.
Too many healthcare networks are built for availability, not containment.
- Flat architectures mean that once a system is compromised, everything is reachable.
- Third-party vendors often connect directly to core environments without segmentation.
- Legacy infrastructure remains exposed because it’s too critical to interrupt and too complex to redesign.
- Cloud adoption adds flexibility but also increases the number of access points that lack visibility and control.
In the most damaging breaches, attackers didn’t break through a firewall or brute-force a system. They used valid credentials. They exploited misconfigurations. They followed data flows from one system to the next because the network lets them.
This is not a tool’s problem. It is a design problem. And it cannot be solved at the edge. It has to be addressed at the infrastructure level, with isolation, segmentation, and containment built into the foundation, not slapped on after the fact.
Understanding Why Is Just the Beginning
Healthcare is not being targeted at random. It is targeted because the data is valuable, the systems are essential, and the vulnerabilities are well understood. From ransomware to espionage, the motivations behind these attacks are complex, but increasingly predictable.
That predictability is the opportunity.
The moment you understand what attackers are after, you can begin shaping infrastructure that limits their reach and minimizes impact.
But understanding why healthcare is being attacked is only the first step. The real challenge is understanding what they’re attacking, how they’re getting in, what it costs when they succeed, and what can be done to stop them.
We’ll explore each of those questions in the rest of this series.
Next Up is Part 2: Inside the Breach – What Hackers Want & How Healthcare Networks Hand it Over
