77% of Ransomware Groups Are Targeting Healthcare. Your Board Should Be Asking Why.
A new analysis confirms what most of us in health IT have known operationally for years: three out of four active ransomware groups are consistently targeting healthcare organizations. Not occasionally. Not opportunistically. Consistently. That number deserves more than a CISO briefing memo. It deserves a board-level response.
Why Healthcare Is Structurally Exposed
Healthcare became a preferred ransomware target not because of any single vulnerability, but because of a structural reality that no patch cycle can fully address. Life-critical operations create pressure to restore systems fast, often before containment is complete. Legacy infrastructure persists because the cost and disruption of replacement is genuinely prohibitive in clinical environments. Federated IT governance, where hospital systems, affiliated physician practices, payers, and clearinghouses share data but not security standards, creates exposure at every integration point.
I have seen this from multiple vantage points. As CIO at NCQA, we were responsible for data standards and quality measures that touched virtually every major health plan and provider in the country. At the Department of Defense, working on EHR development, we operated in a national security context where adversary threat modeling was a baseline assumption. What strikes me about the 77% figure is that it is not a new problem. The scale and professionalism of the threat actors has grown substantially while many healthcare organizations' governance structures have not kept pace.
The 2024 Change Healthcare ransomware attack illustrated the systemic fragility most clearly. A single clearinghouse's compromise disrupted claims processing across the entire U.S. healthcare system, affecting an estimated one-third of all Americans' healthcare transactions. That was not a worst-case scenario. That was the consequence of how deeply interconnected and how poorly segmented our sector's infrastructure has become.
What Most Organizations Are Getting Wrong
The governance gap is wider than the security gap. Across my consulting work, I encounter health systems and health plans that have invested meaningfully in technical controls: endpoint detection, email filtering, and backup solutions. Many have checked the HIPAA Security Rule boxes. Some have pursued HITRUST CSF certification. The problem is that compliance attestation and operational resilience are not the same thing.
HHS OCR enforcement actions tell part of the story. The agency has consistently found that organizations suffering ransomware breaches documented policies without corresponding technical implementation, conducted risk assessments that identified vulnerabilities without remediation follow-through, and failed to test the controls they claimed were in place. OCR's guidance has explicitly affirmed that ransomware infections generally constitute reportable breaches under HIPAA unless the organization can demonstrate, through documented forensic analysis, that protected health information was not accessed or exfiltrated. Most cannot make that demonstration.
The deeper problem is at the governance layer. Boards of health systems and health plans are approving cybersecurity budgets, reviewing compliance summaries, and checking a governance box. They are rarely receiving a ransomware-specific resilience briefing that connects threat actor behavior to their organization's crown jewels, recovery time objectives, and insurance coverage gaps. In my experience, a majority of health system boards could not confidently answer three questions: How long would core clinical operations survive a full EHR outage? Has that assumption been tested within the last 18 months? Does our cyber insurance policy actually cover a scenario of this magnitude, and have we read the exclusions?
Strategic Implications for Healthcare Executives
The 77% targeting figure should change how healthcare executives frame cybersecurity investment. Not as a cost center, but as an operational continuity imperative with direct financial and regulatory exposure.
The regulatory exposure is real and accelerating. HHS's proposed updates to the HIPAA Security Rule, published in early 2025, would codify many technical safeguards that have historically been addressable requirements. Organizations that have treated cybersecurity as an annual compliance review will face significant remediation costs under the updated rule, costs that dwarf proactive investment.
The financial risk extends well beyond ransom payments. IBM's Cost of a Data Breach Report 2024 identified healthcare as the most expensive sector for breach costs for the 14th consecutive year. That figure encompasses regulatory penalties, litigation exposure, notification costs, operational disruption, and reputational damage. Cyber insurers are responding with more aggressive underwriting requirements, and organizations that cannot demonstrate operational controls are seeing coverage limits reduced or premiums climb to levels that strain affordability.
Reputationally, patients are increasingly attuned to how their healthcare providers handle data. A ransomware breach that delays care or compromises records is no longer an abstract reputational risk. It is a patient safety event.
What Healthcare Leaders Should Do Now
Organizations that get this right are not doing anything exotic. They are executing disciplined fundamentals with executive ownership.
Conduct a ransomware-specific board briefing. Not a general cybersecurity update, but a focused session that maps the current threat actor landscape, including successor groups to ALPHV/BlackCat identified in CISA joint advisories with the FBI and HHS, against your specific environment. The board should understand the organization's recovery time objectives, test results, and coverage gaps before the next fiscal year planning cycle.
Test your incident response plan. NIST CSF 2.0 treats response and recovery as distinct disciplines requiring exercised capability, not documented procedures sitting in a SharePoint folder. MTC Group consistently finds that organizations with plans that have never been exercised take two to three times longer to contain and recover from incidents. Executive tabletop exercises must include the CEO, CFO, and General Counsel, not just IT and security staff. Breach counsel should be retained in advance, not identified during the incident.
Align your program to HHS 405(d) HICP. The Health Industry Cybersecurity Practices guidance, developed under the Cybersecurity Act of 2015, provides a healthcare-specific mapping of the NIST CSF to practical controls. It is not a compliance requirement, but OCR has signaled attention to it, and it provides a defensible framework for demonstrating reasonable due diligence.
Close the insurance-reality gap. Review your cyber policy's ransomware coverage limits, sublimits, waiting periods, and exclusions with both your broker and legal counsel. Confirm that pre-incident costs, forensics, notification, and public relations are covered alongside ransom payment coverage. Many organizations discover coverage gaps only after an incident has begun.
The Path Forward
Three out of four ransomware groups are targeting healthcare. That is not a threat intelligence data point for the security team. It is a governance mandate for the board and the C-suite. Healthcare executives have an obligation to their patients, their organizations, and their stakeholders to treat ransomware resilience as an enterprise risk priority.
The organizations that get this right will not necessarily be the ones that spend the most. They will be the ones where the board, the C-suite, and the security function are operating from a shared, tested picture of risk.
If your organization is not there yet, that is precisely what MTC Group LLC is built to help you address.
Sources & Further Reading
77% of Ransomware Groups Are Targeting Healthcare, HIPAA Journal
HHS OCR Breach Portal, U.S. Department of Health & Human Services, Office for Civil Rights
HIPAA Security Rule, HHS Office for Civil Rights
Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients, HHS 405(d) Task Group
NIST Cybersecurity Framework 2.0, National Institute of Standards and Technology
#StopRansomware: ALPHV Blackcat Affiliates Target Hospitals and Healthcare Organizations, CISA, FBI, and HHS Joint Advisory
Cost of a Data Breach Report 2024, IBM Security
Comments