Healthcare Under Siege

The Morning the Screens Went Dark

On December 1, 2024, PIH Health detected a ransomware attack on its network. PIH Health is a nonprofit health system in Southern California. It runs Whittier Hospital, Downey Hospital and Good Samaritan Hospital in Los Angeles, plus urgent care centers, physician offices, home health and hospice services.

According to The HIPAA Journal's account of the incident, multiple systems were taken offline and phone lines were disrupted. Calls to Whittier and Downey were rerouted through Good Samaritan, whose phones still worked. Staff switched to manual downtime procedures and recorded patient data by hand, which delayed care. Two weeks in, PIH Health still had not given a timeline for restoring its systems.

The attackers claimed to have stolen about 2 terabytes of data, including 17 million patient records. PIH Health said at the time it could not verify the ransom note or the data theft claims. The 17 million figure later appeared to be exaggerated or not to relate to unique patients.

The real number arrived more than a year later. PIH Health reported the breach to the HHS Office for Civil Rights as affecting 2,947,264 individuals. It finished mailing notification letters on February 25, 2026.

This is what a healthcare ransomware attack looks like in practice. Not a risk register entry. Not a tabletop exercise. Three hospitals and their clinics running on paper while clinicians care for patients without the systems they rely on every day.

Why Hospitals Are Ransomware's Favorite Target

Healthcare is one of the most targeted sectors for ransomware. The FBI's 2024 Internet Crime Report found ransomware was again the most pervasive threat to critical infrastructure, a group of sectors that includes healthcare. That isn't random. It is a rational economic choice by criminal groups, and the reasons explain the defense challenge.

1. Pressure to Restore Fast

Hospitals cannot tolerate extended downtime. When systems are down, patients are at risk. Delayed diagnostics lead to delayed treatment. Paper processes replace computerized order entry, which raises the chance of medication errors. Emergency departments struggle without their triage and tracking systems.

That urgency creates pressure to pay. The share of hospitals that pay is falling, though. Sophos' State of Ransomware in Healthcare 2025 found 36% of healthcare providers hit by ransomware paid the ransom, down from 61% in 2022. In my view, better backups and faster recovery explain much of that drop, which is why they top this chapter's priorities.

2. Legacy System Dependency

Many hospitals run clinical applications that are well over a decade old. These systems were designed before modern security expectations. Many can't be easily patched, because each change needs validation to make sure it doesn't affect patient safety.

Here is an illustrative view of a typical hospital's technology footprint. The age and patch ranges are my rough estimates from industry experience, not survey data.

System Category	Typical Age	Patch Frequency	Why It Can't Be Easily Updated
Electronic Health Records	5-15 years	Quarterly at best	Requires extensive clinical validation, training and workflow testing
Medical devices (MRI, CT, infusion pumps)	10-20 years	Rarely	FDA-regulated; manufacturer must validate changes
Laboratory Information Systems	10-25 years	Annual	Deeply integrated with analyzers, often running a legacy OS
Building management (HVAC, elevators)	15-30 years	Almost never	IoT/OT convergence gap; vendors may no longer exist
Pharmacy management	5-15 years	Semi-annual	Drug database integrations, regulatory requirements

Some of these systems run on operating systems that no longer receive security updates. They can't always run modern endpoint protection. They are hard to segment because clinical workflows need them to talk across the network. Some are, in a practical sense, permanently vulnerable.

3. The Data Value

Healthcare records sell for more than most other stolen data on criminal markets. Prices vary widely by market and by how complete the record is, so treat any single price figure with caution.

Why so valuable? Healthcare data doesn't expire. You can replace a credit card. You can't change your medical history, and changing your Social Security number is very hard. Healthcare data enables insurance fraud, identity theft, prescription fraud and targeted extortion. A cancer diagnosis or mental health history is powerful leverage for blackmail.

4. Flat Network Architecture

Many hospitals built their networks around function, not security. The radiology department's imaging system (PACS), nursing station EHR terminals, ICU medical devices and administrative billing systems often share a network. At most, they may be separated by basic VLANs with minimal access controls.

That means ransomware that starts in billing can move laterally to clinical systems. The attacker doesn't need to target the EHR directly. They only need a foothold on any system connected to everything else.

The PIH Health Attack: What Is on the Record

Public reporting and PIH Health's own notices support this timeline. I have left out details that were never disclosed, such as the initial access vector or the hour-by-hour response.

November 14, 2024

• An unauthorized party first gains access to parts of PIH Health's network, per PIH Health's later notice

December 1, 2024

• PIH Health detects the ransomware attack
• Multiple systems are taken offline; phone lines are disrupted
• Staff move to manual downtime procedures across its hospitals and clinics

December 2024

• The attackers claim to have stolen about 2 TB of data, including 17 million patient records and data on more than 8.1 million "medical episodes"
• PIH Health says it can't verify the ransom note or the theft claims
• Some stolen data is leaked online after the ransom demand
• As of December 13, PIH Health has not given a restoration timeline

December 23, 2024

• The end of the unauthorized access window, per PIH Health's later notice

December 16, 2025

• After a long file review, PIH Health confirms that patient information was in files that may have been accessed or acquired

February 25, 2026

• PIH Health completes mailing notification letters
• The breach appears on the HHS OCR breach portal as affecting 2,947,264 individuals

Sources: The HIPAA Journal, and GovInfoSecurity for the attackers' claims.

Two details stand out. First, the access window ended three weeks after detection, which shows how hard it is to evict an intruder fully. Second, the gap between the attack and individual notification was well over a year. Reviewing millions of stolen files to work out whose data was in them takes time.

The Real Cost: Beyond the Ransom

The ransom is often the smallest part of the financial impact. PIH Health has not published its costs, so the ranges below are my planning ranges for a mid-size health system, not data from any single incident.

Cost Category	Planning Range
Ransom payment (if paid)	$500K to $5M
Incident response and forensics	$500K to $2M
System restoration and rebuilding	$2M to $10M
Lost revenue (diverted patients, cancelled procedures)	$5M to $20M
Regulatory penalties (HIPAA, state)	$100K to $2M
Legal costs (class action defense)	$2M to $10M
Settlements	$5M to $50M
Increased cyber insurance premiums (3-5 years)	$1M to $5M
Staff overtime and temporary workers	$500K to $2M
Reputation damage and patient attrition	Difficult to quantify

Survey data points the same direction. IBM's Cost of a Data Breach Report 2026 puts the global average breach at $4.99 million. Healthcare again had the highest average of any industry, at $6.64 million, per eSecurity Planet's summary of the report. Those averages cover all breaches. Ransomware with weeks of clinical downtime sits at the expensive end.

Anatomy of a Healthcare Ransomware Attack

Understanding the attack lifecycle shows where defenses work best. The stages and timings below describe a common pattern, not the PIH Health incident.

Stage 1: Initial Access (Day 0)

Common initial access vectors for healthcare ransomware include:

• Phishing emails: Targeted at billing, HR or administrative staff who routinely open attachments and links
• Exploiting public-facing applications: Vulnerabilities in VPN appliances, remote access gateways or web-based patient portals
• Compromised credentials: Credentials bought from earlier breaches, or brute-force attacks on exposed remote desktop (RDP)

Across all industries, Verizon's 2025 Data Breach Investigations Report found credential abuse was the top initial access vector (22% of breaches), with vulnerability exploitation close behind at 20%.

Stage 2: Establishing Persistence (Days 0-1)

The attacker installs backdoors to keep access even if the first entry point is found. Common techniques:

• Deploying legitimate remote management tools (AnyDesk, TeamViewer, Splashtop) that blend in with normal IT operations
• Creating new administrative accounts in Active Directory
• Installing web shells on internet-facing servers
• Modifying scheduled tasks to run attacker tools

Stage 3: Lateral Movement (Days to Weeks)

This is where a flat network becomes dangerous. The attacker uses stolen credentials to move across the network:

• Active Directory enumeration to find high-value targets
• Pass-the-hash and Kerberoasting attacks to escalate privileges
• Mapping network shares to find backup systems and clinical databases
• Moving from IT networks to clinical networks, which poor segmentation makes easy

Stage 4: Data Exfiltration

Before encrypting anything, most ransomware groups now steal data. That gives them a second lever. Even if the hospital restores from backups, the attackers threaten to publish patient data.

• Patient records (PHI) compressed and uploaded to cloud storage or attacker infrastructure
• Financial records and employee data copied out
• Internal documents that could embarrass the organization
• Volumes that can run to terabytes, as the 2 TB claimed in the PIH Health case shows

Stage 5: Encryption and Ransom

The final stage is the visible attack:

• Backup systems destroyed or encrypted first
• Volume shadow copies deleted
• Ransomware deployed across all reachable systems at once
• A ransom note dropped on every encrypted system
• A negotiation channel opened, typically a Tor-based chat

Critical Infrastructure Security Priorities

If you lead security or IT at a healthcare organization, here are the investments I would prioritize. They are the controls that break the attack chain above, in order.

Priority 1: Immutable, Offline Backups

Nothing else matters if you can't restore. The most important investment is backup infrastructure ransomware cannot reach.

• Keep offline (air-gapped) copies of all critical systems
• Use immutable storage that blocks deletion or modification for a defined retention period
• Test restoration monthly, not annually
• Measure and practice your Recovery Time Objective (RTO): can you restore the EHR in 24 hours? 48? 72?

Priority 2: Network Segmentation

Break up the flat network. Clinical systems should not be reachable from administrative networks without passing through a controlled access point.

• Segment clinical, administrative, medical device and guest networks
• Micro-segment around high-value clinical systems (EHR, PACS, pharmacy)
• Deploy network detection and response (NDR) at segment boundaries
• Enforce zero trust network access for remote and vendor connections

Priority 3: Privileged Access Management

Most lateral movement relies on stolen privileged credentials. Controlling privileged access sharply limits how far an attacker can go.

• Deploy a privileged access management (PAM) tool with just-in-time access for administrative accounts
• Remove standing administrative privileges wherever possible
• Require multi-factor authentication on all administrative access, with no exceptions
• Monitor for unusual use of administrative credentials

Priority 4: Email Security and User Training

Phishing remains a primary entry point. Layer technical controls with human awareness.

• Deploy email filtering with URL rewriting and attachment sandboxing
• Implement DMARC, DKIM and SPF to prevent domain spoofing
• Run regular phishing simulations for all staff, including physicians
• Create a simple, no-blame way to report suspicious emails

Priority 5: Medical Device Security

Medical devices are often the largest unmanaged attack surface in a hospital.

• Keep a complete inventory of connected medical devices
• Put medical devices on isolated network segments
• Monitor device network behavior for anomalies
• Write security requirements into procurement contracts
• Plan device replacement before operating system support ends

The Regulatory Reckoning

Healthcare organizations face a demanding regulatory process after a ransomware attack. Under the HIPAA Breach Notification Rule, a covered entity must notify affected individuals without unreasonable delay, and no later than 60 days after discovering a breach. For breaches affecting 500 or more residents of a state, it must also notify prominent media outlets and HHS within that window.

The HHS Office for Civil Rights can impose tiered civil money penalties. The annual caps per type of violation are adjusted for inflation each year. State attorneys general can also act, and class action lawsuits often follow public breach notification.

In my experience, the legal and regulatory tail of a large healthcare breach typically looks like this. Treat it as a planning pattern, not a fixed schedule:

• Within 60 days of discovery: Notifications to individuals, HHS and, for large breaches, the media
• Months after notice: HHS OCR and state attorney general inquiries begin; class actions are filed
• One to two years: Lawsuits move through motions and discovery
• Two to five years: Settlements, resolution agreements or trials

PIH Health shows how stretched the first step can get. Individual notifications were completed more than 14 months after the attack, because identifying whose data was in the stolen files took that long.

The organizations that fare best can show they had reasonable controls before the attack and responded well afterward. Documentation matters. If your incident response plan exists only as a PDF nobody has reviewed in two years, it can look like evidence of negligence, not preparedness.

The Human Cost

Behind the financial figures, healthcare ransomware has a human cost that is hard to measure and impossible to ignore.

Researchers have now measured it. A study by Hannah Neprash, Claire McGlave and Sayeh Nikpay linked hospital ransomware attacks to Medicare claims data. It was published in the American Economic Journal: Economic Policy. It found that ransomware attacks cut hospital volume by 17 to 24 percent in the first week. For patients already admitted when an attack began, in-hospital mortality rose by 34 to 38 percent.

People die when hospitals go down. This is not hypothetical. It's measured.

That's why healthcare cybersecurity is not only an IT problem. It's a patient safety problem. It belongs in the same conversation as medication safety, surgical safety and infection control, with the same commitment, investment and leadership attention.

The attackers know this. They count on it. And they aren't going to stop.