Cybersecurity in the healthcare sector: How to protect patients and organisations

The growing number of cyberattacks and the critical nature of the services provided by hospitals and other organisations make it essential to strengthen cybersecurity in the healthcare sector

How can a hospital function if a security incident renders its IT systems unusable? This premise forms the basis of one of the storylines in the second series of The Pitt, one of the most-watched series in recent years, which is set in the A&E department of an American hospital. This drama highlights the paralysis that a cyberattack on a hospital can cause and the challenge of treating patients whilst having to revert to pen and paper.

But there is no need to turn to fiction to address the consequences of failing to strengthen cybersecurity in the healthcare sector. In recent years, attacks on organisations in this critical sector have multiplied: hospitals, pharmaceutical companies, health insurers, manufacturers of IoT medical devices…

In Spain, the most infamous incident involved one of the country’s leading public hospitals. Following a ransomware attack on its systems, the hospital was forced to operate using analogue methods for days, cancelling operations and referring A&E patients to other hospitals. Furthermore, the malicious actors behind the incident exfiltrated 4.5 TB of data onto the Dark Web.

A subsequent investigation by the Catalan Data Protection Authority concluded that the hospital lacked the security measures necessary to provide even basic protection against cyber-attacks.

This case demonstrates that strengthening cybersecurity in the healthcare sector is a critical issue that must form part of the strategies of organisations operating in the sector.

Below, we will review the threat landscape and to highlight why cybersecurity solutions are needed in the healthcare sector and in hospitals in order to increase organisations’ cyber resilience and protect patients..

What are malicious actors looking for when they attack organisations in the healthcare sector?

According to ENISA, the EU’s cybersecurity agency, the healthcare sector is the hardest hit by significant incidents. Furthermore, this agency reported that 54 per cent of incidents are caused by ransomware attacks.

Why are malicious actors launching an increasing number of cyberattacks against the healthcare sector?

• Healthcare organisations handle large volumes of particularly sensitive information: patients’ medical records, financial information, intellectual and industrial property… This information can be monetised by:
  • Selling patients’ or healthcare professionals’ data on the Dark Web. In fact, medical information commands a significantly higher price on the black market.
  • Using it to launch fraudulent campaigns or steal the identities of people whose data has been stolen.
  • Extorting the organisations that have been attacked.
  • Selling intellectual or industrial property to rival companies.
• IT systems are essential for healthcare organisations and, in particular, for hospitals. Without them, providing medical care to patients poses an enormous challenge. Consequently, attacks can lead to serious incidents that affect the organisations’ operations. In the case of the healthcare sector, this can have repercussions for patients’ health and put their own well-being at risk.
• Many organisations do not have a cybersecurity strategy for the healthcare sector that is robust enough and allocate only a limited budget to this area. Consequently, they are easier targets for malicious actors than organisations in other sectors, where more resources are allocated to strengthening their cybersecurity posture.
• The use of outdated software and hardware or equipment that has reached the end of its life cycle opens the door for malicious actors to detect and exploit unpatched vulnerabilities.
• The low level of awareness amongst staff and senior management within organisations regarding cybersecurity risks.

What are the main cybersecurity threats in the healthcare sector?

The major threats to cybersecurity in the healthcare sector are:

• Ransomware attacks. As noted earlier, half of all incidents stem from the use of this type of malicious software to hold organisations’ data to ransom.
• Data breaches and leaks following successful access to organisations’ systems using social engineering techniques.
• Supply chain attacks, exploiting vulnerabilities in the hardware or software of IT suppliers.
• Distributed denial-of-service (DDoS) attacks to undermine the availability of systems.

These types of threats can give rise to two of the major risks facing the healthcare sector:

• Access to patients’ medical information.
• Disruption to healthcare provision.

Which organisations are being targeted by malicious actors?

It is estimated that there are more than 2,400 attacks per week against organisations in the healthcare sector, and this figure is rising. Furthermore, attacks are increasing not only against hospitals, but also against laboratories, health authorities and pharmaceutical companies. For this reason, cybersecurity in the healthcare sector affects a wide range of organisations:

• Public healthcare systems. The case discussed at the start of this article on cybersecurity in the healthcare sector shows that malicious actors have public healthcare systems in their sights. So much so that the chief executive of the NHS, the British health service, has warned that the risk of cyberattacks is rising dramatically. In fact, in 2026, a Polish public hospital had to revert to paper records after being unable to access its IT systems due to an incident. Meanwhile, the public body that manages blood donations in France recently suffered attacks on several of its blood banks, which affected their refrigeration equipment.
• Hospitals. In early 2026, a ransomware attack disrupted the IT systems of a Belgian hospital and forced it to refer critically ill patients to other centres. Months later, another attack forced a US organisation to close ten of its centres in South Carolina.
• Laboratories. In October 2026, German police arrested an individual linked to the criminal group that, in 2024, had launched a cyberattack against the laboratory responsible for processing blood tests for several London hospitals. The incident affected the city’s entire healthcare system and was a key factor in the death of a patient.
• Pharmaceutical companies. In August 2026, a pharmaceutical company that supplies a third of prescription medicines to hospitals and pharmacies in the United States and Canada reported a security incident affecting its information systems. It also confirmed that the attackers had managed to steal data from its Oncology and Medical-Surgical departments. A few weeks earlier, another multinational had disclosed an incident that had affected information relating to patients participating in its clinical trials.
• Health insurers. In 2024, one of the leading health insurers in the United States suffered a ransomware attack that affected billing and treatment authorisation processes, had repercussions for most hospitals in the country and resulted in access to sensitive health information belonging to 190 million people. In fact, in October 2026, the US Senate passed a Healthcare Cybersecurity Act to prevent incidents such as this, requiring organisations in the sector to adopt protective measures
• Suppliers of IoT medical devices and medical software. In July 2026, a multinational company specialising in the development of medical technology reported that it was investigating two incidents relating to unauthorised access to the systems of its cancer diagnostics unit and to a portal used by its laboratory diagnostics division. A few weeks later, it was confirmed that another company providing software-as-a-service to hospitals and medical centres had suffered an incident in which the data of 9.5 million patients, including medical information, had been exposed
• Technology companies developing treatments. In September 2026, a company that has developed a non-invasive cancer treatment suffered an incident in which the data of 1,400 patients was exposed.

These are just a few examples that highlight the importance of strengthening cybersecurity in the healthcare sector.

NIS2, GDPR, MDR… Strengthening cybersecurity in the healthcare sector is a must

As we have just noted, a law has recently been passed in the United States to strengthen cybersecurity in the healthcare sector, but what is happening in the European Union?

In recent years, regulations have been adopted that seek to strengthen cybersecurity in the healthcare sector and ensure that organisations in the sector are resilient to attacks. Which regulations are we referring to?

• The NIS2 Directive includes healthcare within its list of critical sectors. This means that organisations in the sector are obliged to implement a security strategy that enables them to analyse risks, manage vulnerabilities and incidents, prevent supply chain attacks and report incidents.
• The GDPR imposes a duty on companies and public authorities to have security measures in place to prevent unauthorised access to personal data. Given the sensitive nature of medical data, protecting it is crucial, and organisations that fail to safeguard it face substantial fines. For example, in September 2026, a French hospital was fined €500,000 for a data breach affecting more than 700,000 patients.
• The MDR Regulation on medical devices sets out the cybersecurity requirements for medical devices.

What are the benefits of strengthening cybersecurity in the healthcare sector

Having a cybersecurity strategy in the healthcare sector is key to:

1. Carrying out risk assessments to implement measures tailored to those risks that are effective in protecting an organisation’s systems and patients’ information.
2. Detecting vulnerabilities present in its technological infrastructure, taking into account devices and software from suppliers to prevent supply-chain attacks.
3. Managing vulnerabilities and prioritising their remediation based on the impact they may have on the organisation.
4. Training staff to prevent them from falling victim to social engineering campaigns and deepfakes.
5. Have a robust and tested incident response plan in place to act from the very first minute and limit the impact of an attack, whilst safeguarding the continuity of healthcare.
6. Comply with all regulatory requirements on cybersecurity in the healthcare sector and data protection. This will also help avoid substantial fines and legal disputes.

How can a cybersecurity strategy be implemented in the healthcare sector?

To design and optimise a cybersecurity strategy in the healthcare sector, it is vitally important to have access to services such as:

• Security audits of IT systems and IoT devices to identify weaknesses that could put them at risk.
• Vulnerability management to streamline and prioritise the mitigation of identified weaknesses and prevent them from being successfully exploited by malicious actors.
• DoS tests to assess the levels of overload on internet-facing services and the capacity of backend systems to cope with massive loads, with a view to preventing service outages.
• Social engineering tests to simulate realistic phishing campaigns, assess an organisation’s staff’s ability to detect them, and train and raise awareness amongst all professionals.
• Penetration testing. Advanced penetration tests are carried out to simulate real attacks in controlled environments. What is the aim? To identify critical vulnerabilities that could be exploited by malicious actors to steal patients’ medical data, cause an organisation’s IT systems to crash, install ransomware or other malicious software, or gain unauthorised access to confidential and high-value information.
• Proactive incident response. Conducting incident drills and threat analyses enables organisations to improve their efficiency in managing incidents and identifying threat actors. Furthermore, through a proactive incident response service, an incident response plan can be drawn up and updated to enable a response to any attack with the utmost speed, identify the scope of the breach, expel the malicious actor, ensure the continuity of services and restore normal operations in the shortest possible time.

In short, faced with an increasingly challenging threat landscape, cybersecurity in the healthcare sector has become a strategic issue for public and private organisations in the healthcare sector.

Protecting patients’ medical information and ensuring the continuity of healthcare is of vital importance not only for the organisations involved, but for society as a whole.

The most serious security incidents can cause severe financial and reputational damage, lead to legal repercussions and even affect people’s health.

It is therefore essential to invest in cybersecurity within the healthcare sector, continuously optimise protective measures and strengthen resilience against security incidents.