Why Hospitals Are a Common Ransomware Target
Hospitals can't afford downtime the way most businesses can, which is exactly what makes them an attractive ransomware target. Walk through one attack scenario below and see how a handful of basic defenses stop most of them before they start.
Most businesses hit by ransomware can wait a few days to pay or recover before real damage sets in. A hospital cannot — its systems control which patient gets which medication, right now — and that single difference is exactly why hospitals are one of the most common ransomware targets in existence.
Hospitals are a common ransomware target, and here's why
Ransomware works by locking an organisation out of its own systems until it pays. That threat only has teeth if the organisation cannot simply wait it out — and a hospital, unlike almost any other kind of business, cannot pause patient care for a week while IT rebuilds servers from backup. Attackers know this, and it is exactly why healthcare is such an attractive target.
The way in is rarely a sophisticated exploit. It is a phishing email, and clinical staff are a specifically good target for one — not because they are careless, but because the job trains a reflex an attacker can write straight against. A nurse fourteen patients into a shift, or a doctor between rooms, is primed to act fast on anything marked urgent: a lab result, a scheduling alert, a message from “IT” about a locked account. That is precisely the instinct a well-written phishing email depends on, and healthcare's own urgency culture makes it a more reliable target than the same email sent to an office worker with time to pause.
A device that cannot be patched is a permanent hole
Patch a laptop and the update finishes in minutes. Patch an MRI machine, and a hospital often cannot do it at all. Medical imaging and monitoring equipment routinely stays in service for well over a decade, frequently on an operating system that stopped getting security updates long ago. The hospital usually isn't allowed to patch it on its own: the device maker controls the software, has to test every change against the device's validated, cleared configuration before releasing it, and may stop supporting older models entirely. US regulators have said routine security patches generally don't need a fresh review — but a fix nobody ships is a fix the hospital never gets.
The result is a building full of machines nobody can safely update, sitting on the same network as the record system, the scheduling system, and everything else. Network segmentation exists mostly because of exactly this: an unpatchable scanner isolated on its own segment can be infected without that infection reaching the record system next door. The same scanner sitting on the general hospital network turns one permanently vulnerable device into an open door for the whole building.
What a single breach actually costs a hospital
Walk through what one real attack looks like, from the moment it lands to what stopping it would have required.
The attachment silently installs ransomware, which spreads across the hospital network overnight and encrypts patient records, scheduling systems, and even some connected medical devices by morning. Staff arrive to find they cannot pull up a single chart. Scheduled surgeries get postponed, ambulances get diverted to other facilities, and the hospital faces a ransom demand — often in the hundreds of thousands to millions of dollars — with patient safety, not just data, now on the line.
This exact chain of events — one email, one click, a hospital-wide shutdown by morning — has happened at real hospitals, not as a hypothetical.
A retailer measures an outage in lost sales — recoverable the moment the site comes back up, refunded or resold the next day. A hospital's downtime does not reverse that cleanly. An ambulance diverted to another facility during an outage is a delay in someone's care that has already happened, not a transaction that can simply be replayed once the systems return. That is the real unit of cost here, and it rarely shows up as a line item next to the ransom figure.
The number attackers actually ask for, and the one that makes headlines — often the smallest real cost of the three.
Days of postponed surgeries and paper-chart workarounds while systems are rebuilt from backup, if backups exist at all.
Ambulances redirected and appointments cancelled during the outage — a delay that already happened to a real patient and cannot be undone by restoring a server.
The basic defenses that stop most attacks
Staff training that makes that specific email look suspicious before anyone clicks it. Network segmentation that keeps one infected computer from spreading to every other system in the building. Offline, regularly tested backups that let the hospital restore its records without paying anyone, because the ransom's entire leverage depended on there being no other way back in.
None of these three are exotic security research — they are the same basic hygiene most industries already treat as table stakes.
Key takeaways
- Hospitals are a disproportionate ransomware target because they cannot pause patient care to wait out an attack the way most businesses can.
- Attackers targeting healthcare aim at urgency, not carelessness — clinical staff working under time pressure are primed to act fast on anything marked urgent, which is exactly the instinct phishing depends on.
- Legacy imaging and monitoring equipment often can't be patched by the hospital at all — the device maker controls and validates every software change, and may stop supporting older models — leaving networks full of machines nobody can safely update.
- Staff training, network segmentation, and offline tested backups stop most of these attacks before they start, and none of the three are exotic or expensive relative to a single ransom payment.
- The real cost of hospital downtime isn't a dollar figure — it's a diverted ambulance and a delayed diagnosis, neither of which gets undone once the systems come back online.
Before you move on
Quick check
Answer these to unlock the next chapter: 3 of 4 to pass. You can retake it anytime.
Make a free account to read on
Every chapter is free — an account lets your course progress follow you from your laptop to your phone. No payment, no trial.