Healthcare ranked among the most targeted sectors in 2022, with ransomware attacks climbing 93% from 2020 levels. The United States bore the brunt, experiencing 37 of the 58 documented attacks globally, while the Hive ransomware group dominated healthcare-focused operations. Beneath these statistics lies a more alarming reality: ransomware in healthcare transcends data encryption—it actively compromises patient care delivery.
The short version
- Ransomware attacks on healthcare surged 93% between 2020 and 2022
- US healthcare organizations suffered 37 of 58 publicly disclosed attacks in 2022
- Hive ransomware group led healthcare targeting efforts
- More than half of healthcare ransomware victims experienced care delivery disruptions
- Average recovery costs reached $10.1 million per incident
Why healthcare is the soft target
Patient health information is uniquely valuable. It combines personally identifiable information, medical histories, and often insurance data—creating a comprehensive profile that commands premium prices on underground markets. A single patient registration can fetch $1,000 on criminal networks.
But data value alone doesn't explain the sector's appeal. Healthcare is uniquely time-sensitive. A patient record that exists but cannot be accessed is operationally identical to a missing one. That time pressure gives attackers use that credit card fraud never achieves. Organizations under active attack cannot simply wait out the encryption; lives depend on immediate access.
Our analysis
The case study that should be on every healthcare CISO's desk is the Centre Hospitalier Sud Francilien, near Paris. The hospital had to divert patients and postpone surgeries during a ransomware incident. That is a clinical risk, not a data risk—and most hospital security programmes are still funded and measured on the data axis.
The LockBit apology to SickKids in Toronto is worth holding. It is often cited as evidence that ransomware groups have ethical lines. The more honest reading: the affiliate broke the group's own rules, and the brand moved to protect future revenue. Do not plan your defence around attacker ethics.
Who should care
| Stakeholder | Primary concern | What to watch |
|---|---|---|
| Regional hospital CISOs | Operational continuity | Backup integrity, downtime drills |
| Clinical leadership | Care delivery | Staff paper-chart proficiency |
| Patients | Identity and health data | Breach notifications, credit monitoring |
| Regulators | Reporting compliance | HIPAA 60-day disclosure rules |
| Insurers | Exposure aggregation | Sector-wide incident trends |
What it means for you
Say you are a security lead at a regional hospital. The single highest-value control you can buy is not a new endpoint detection tool. It is a tested, offline, immutable backup of your EHR, plus a rehearsed downtime procedure that clinical staff actually know how to use. Run a paper-chart drill every quarter. The day you actually need it, the IT team will not be the one running the hospital; the nurses will be.
The 2022 numbers are bad. The pipeline of sophisticated ransomware groups targeting this sector suggests 2023 will not be better.
Key takeaways
- Healthcare ransomware is rising fast, and the cost is measured in patient safety, not just dollars.
- Hive led the sector in 2022, but the threat is broad and affiliate-driven.
- Offline, immutable backups and rehearsed clinical downtime procedures are the controls that matter most.
- Patient data carries premium value, making healthcare an ongoing target regardless of individual organizational size.
- Breach reporting requirements exist, but enforcement and universal standards remain inconsistent.
Frequently asked questions
How much did healthcare ransomware attacks grow from 2020 to 2022?
Attacks increased 93% during that period, making healthcare one of the top three targeted industries.
Which ransomware group was most active in healthcare in 2022?
Hive was the most active ransomware group targeting the healthcare sector that year.
What is the average recovery cost for a healthcare ransomware attack?
Around $10.1 million, though smaller facilities may face proportionally larger budget impacts relative to their resources.
Why is patient data so valuable to attackers?
It combines PII, personal health information, and sometimes financial data. Each patient registration can command $1,000 on criminal networks, and the data remains valuable whether or not organizations pay ransoms.
What happened with the LockBit attack on SickKids?
LockBit issued an apology and provided a free decryptor to SickKids hospital in Toronto after an affiliate violated the group's own operational rules. This was an exception, not a pattern.
Inspired by reporting from: blackfog.com