The numbers coming out of the healthcare sector in 2026 are not subtle. The average ransom demand across confirmed healthcare ransomware incidents has reached $16.9 million — up from $577,800 the prior quarter. Attack volume has dropped, but threat actors have recalibrated their targeting toward larger organizations and their demands accordingly. One high-profile attack resulted in a $22 million ransom payment, which signaled to every ransomware group operating in the space that healthcare organizations will pay when clinical operations are at risk.

Seventy-seven percent of healthcare organizations reported being targeted by ransomware in the past twelve months. Fifty-three percent of those attacks succeeded in deploying ransomware. These are not statistics from a sector that has hardened its defenses. They are statistics from a sector that has consistently underinvested in cybersecurity while holding some of the most valuable and regulated data that exists.

The regulatory and governance response to this reality is now taking shape. Cybersecurity in healthcare is no longer being treated as a technical IT problem. It sits, alongside patient safety and operational continuity, as a board-level leadership obligation — and regulators are beginning to enforce it accordingly.

How We Got Here

The trajectory of healthcare ransomware is not surprising to anyone who has followed incident response in the sector. Healthcare organizations hold protected health information that has consistent resale value on criminal markets, maintain legacy infrastructure that creates persistent attack surfaces, and operate in environments where systems downtime has direct patient safety consequences — which means the pressure to pay rather than restore is embedded in the threat model.

The Change Healthcare attack in early 2024, which resulted in a $22 million ransom payment and months of claims processing disruption across the US healthcare system, reset the expectations of ransomware groups operating in this space. The payment confirmed that large healthcare organizations will authorize eight-figure payments when clinical operations are crippled. That lesson has been absorbed.

In Q1 2026, there were 201 confirmed ransomware attacks on healthcare sector organizations — 120 on hospitals, clinics, and direct care providers, and 81 on vendors and business associates operating within the sector. Qilin was the most active group targeting healthcare providers, accounting for 23 claimed attacks and four confirmed incidents across the US and Germany. Akira, LockBit successors, and BlackCat rebrands continued to operate against healthcare targets.

Why Attacks Keep Succeeding

Healthcare IT security leaders consistently identify two structural factors that make their environments persistently vulnerable despite increased spending on security tooling.

Unmanaged Unstructured Data

Modern healthcare organizations accumulate vast quantities of unstructured data — scanned documents, imaging files, clinical notes, voicemails, emails, legacy database exports — spread across file shares, cloud storage buckets, backup systems, and departmental applications. This data frequently contains PHI. It is rarely inventoried. It is almost never governed consistently.

When ransomware actors exfiltrate before encrypting — the double-extortion model that now dominates healthcare attacks — unstructured data is frequently what they take. Organizations that cannot answer basic questions about what PHI is contained in which file shares are also organizations that cannot assess the scope of a breach accurately, which extends the notification window and compounds regulatory exposure.

The HIPAA Security Rule’s information asset inventory requirements have always required covered entities to maintain an accurate accounting of ePHI locations. In practice, most organizations’ inventories are incomplete, outdated, or siloed by department. Threat actors have noticed.

Legacy Infrastructure

Healthcare organizations operate on infrastructure cycles that do not match commercial IT timelines. Clinical devices — infusion pumps, imaging systems, patient monitors — may run for fifteen to twenty years. Operating systems embedded in those devices go end-of-life long before the devices are decommissioned. Network segmentation that would isolate clinical devices from IT infrastructure is expensive and operationally disruptive to implement after the fact.

The result is attack surfaces that are well-documented in criminal forums. Many healthcare ransomware campaigns begin with credentials obtained through phishing against general IT staff, pivot through internal networks to clinical systems with known vulnerabilities, and achieve broad lateral movement before any detection capability fires.

The Board Accountability Shift

For most of the past decade, healthcare boards treated cybersecurity as a standing agenda item in the category of “IT risk” — reviewed annually, reported on by the CISO, noted, and moved past. That model is over.

The combination of nine-figure ransom payments, multi-month operational disruptions, and federal enforcement actions against executives has established cybersecurity as a direct fiduciary concern. A board member who cannot demonstrate that they received, understood, and acted on reasonable cybersecurity risk reporting is exposed — not hypothetically, but based on the trajectory of HHS enforcement posture and the guidance issued by OCR in the aftermath of major breach settlements.

A 2025 Censuswide survey found that 77% of healthcare organizations were targeted with ransomware in the past twelve months. The same survey found that executive awareness of specific vulnerabilities — as opposed to general awareness that cybersecurity is a risk — remains low at the board level. Boards are aware that ransomware is a sector problem; they are frequently not aware of the specific control gaps in their own organizations that create the exposure.

This awareness gap is the accountability gap. Regulators and plaintiffs’ attorneys are both paying attention to it.

What OCR Expects from Leadership

The Office for Civil Rights has made clear in enforcement correspondence and settlement agreements over the past three years that it expects covered entity leadership — not just technical staff — to be accountable for HIPAA Security Rule compliance. Specifically:

  • Risk analysis must be a documented, enterprise-wide process reviewed by leadership, not a point-in-time technical assessment
  • Risk management must result in documented remediation plans with assigned owners and deadlines, tracked to completion
  • Workforce training must be verified, not assumed
  • Business associate agreements must be current and must reflect actual data flows

In investigations following major ransomware incidents, OCR has consistently found that the underlying security program failures — inadequate access controls, missing MFA, unpatched vulnerabilities, absent network segmentation — were known deficiencies that had been identified in prior risk analyses and not remediated.

The settlement in the Change Healthcare investigation is still pending, but the enforcement pattern established by OCR in prior major breach settlements — Advocate Aurora, CommonSpirit, Scripps Health — suggests that institutions whose security programs cannot demonstrate that leadership received and acted on risk findings will face the steepest penalties.

The HIPAA Security Rule Intersection

The relationship between ransomware and HIPAA enforcement is direct. A ransomware attack is presumed to be a breach under the HIPAA Breach Notification Rule unless the covered entity can demonstrate that ePHI was not accessed or exfiltrated — a showing that is nearly impossible to make in a double-extortion attack where threat actors demonstrably held data during ransom negotiations.

This means a successful ransomware attack is, in almost all cases, both a clinical incident and a HIPAA breach triggering notification obligations to:

  • Affected individuals (within 60 days of discovery)
  • HHS OCR (within 60 days, with prominent website notice if more than 500 individuals in a state are affected)
  • Media outlets in affected states (if more than 500 individuals in a given state are affected)

For organizations with multiple locations and a dispersed patient population, this means simultaneous multi-state media notification obligations alongside the operational crisis of restoring clinical systems. Organizations that have not pre-built their notification processes — pre-drafted templates, pre-identified media contacts, pre-arranged legal review workflows — are adding to the crisis under deadline pressure.

What the Updated HIPAA Security Rule Adds

OCR published a proposed overhaul of the HIPAA Security Rule in December 2024, targeting finalization in May 2026. Whether or not the final rule publishes this month — a question addressed in detail in a companion article — the direction of travel is clear and organizations should be planning toward it regardless:

  • Multi-factor authentication becomes mandatory, not addressable, for all access to ePHI systems
  • Encryption at rest and in transit becomes mandatory for all ePHI, with no distinction between production and backup environments
  • Network segmentation between clinical and administrative systems becomes a required administrative safeguard
  • Annual penetration testing and regular vulnerability scanning become required
  • Business associate verification — actual verification of BA security controls, not just a signed BAA — becomes required

For most organizations, the gap between current state and the proposed rule’s requirements is material. MFA is not universally deployed across clinical applications. Encryption is inconsistently applied to backup media. Network segmentation between clinical and IT networks is incomplete in the majority of mid-size facilities.

The compliance window, if the rule finalizes this month, is approximately 240 days — running to early 2027. Organizations that have not yet assessed their gap should begin immediately.

Immediate Steps for Covered Entities

Conduct a tabletop ransomware exercise at the board level. The exercise should include not just IT and security leadership but the CEO, CFO, and board members. Walk through the decision tree: a ransomware demand has been received, clinical systems are down, patient care is affected. Who authorizes what. What the notification obligations are. Who contacts OCR. Who contacts the media. What the ransom payment decision process looks like. Boards that have never been through this exercise are unprepared for the actual event.

Complete a current-state risk analysis. A HIPAA-compliant risk analysis is not a vendor vulnerability scan. It is a documented, enterprise-wide assessment of the likelihood and impact of threats to ePHI confidentiality, integrity, and availability. If your last risk analysis is more than twelve months old or was limited in scope to IT systems, it needs to be updated before the next OCR inquiry.

Inventory your unstructured data. Identify where ePHI exists in file shares, email archives, backup systems, and departmental storage. This is the first step in both reducing your exfiltration exposure and enabling accurate breach scope assessment after an incident.

Map your business associate landscape. Every vendor with access to ePHI should have a current BAA. Every BAA should reflect the actual data access the vendor has. Vendors that hold ePHI but lack current agreements are a compliance problem before they are a security incident. After an incident, they are a compounded problem.

Harden identity and access. MFA for all remote access to clinical systems. Privileged access management for administrative accounts. Access reviews on a quarterly cadence. These are not sophisticated security measures — they are foundational controls whose absence is the root cause of most successful ransomware attacks.

Conclusion

The $16.9 million average ransom demand is not an anomaly — it is the calibrated result of threat actors who have observed what healthcare organizations will pay and who understand the clinical leverage they hold. The sector’s security problem is structural, it is documented, and it is worsening.

The regulatory response — an updated HIPAA Security Rule, increasingly aggressive OCR enforcement, and a clearly articulated expectation that board-level leadership is accountable for security program adequacy — is designed to force the structural changes that voluntary investment has failed to produce.

Healthcare organizations that treat this as a compliance exercise to be managed will continue to pay ransoms. Organizations that treat it as a patient safety and fiduciary governance issue are building toward security programs that can actually change the odds.

This article is provided for informational purposes only and does not constitute legal advice. Organizations should consult qualified legal counsel and qualified cybersecurity professionals regarding their specific obligations and security posture.