Ransomware continues to pose a severe threat to the healthcare sector, according to the State of Ransomware in Healthcare 2024 report from Sophos. While attacks have decreased in many industries, healthcare organizations are increasingly targeted. With 67% of healthcare providers reporting a ransomware attack in the past 12 months, up from 60% in 2023, the sector now faces the second-highest attack rate globally, trailing only central governments.
One of the key issues contributing to healthcare’s vulnerability is the reliance on outdated technology and legacy infrastructure. Sophos notes that this older technology makes it more difficult for organizations to secure their systems, prevent lateral movement, and stop ransomware from spreading. As a result, an average of 58% of healthcare organizations’ devices were affected in ransomware attacks, with 7% of organizations reporting that over 91% of their devices were impacted.
The report also sheds light on the most common attack vectors in 2024, with exploited vulnerabilities and compromised credentials each accounting for 34% of attacks. Malicious emails were responsible for 19% of attacks, while phishing incidents dropped to 9%, down from 14% in 2023. Additionally, brute force attacks, which involve attackers trying to gain unauthorized access through continuous attempts, increased from 1% in 2023 to 4% in 2024.
Another alarming trend is the increasing recovery time from ransomware incidents. In 2024, 37% of healthcare organizations took more than a month to recover, up from 28% in 2023. The percentage of organizations able to recover in less than a week has also plummeted, from 47% in 2023 to just 22% this year, reflecting the growing complexity of attacks.
Double extortion tactics continue to play a significant role in ransomware attacks, where data is stolen before being encrypted. In some cases, victims are forced to pay ransoms not only to regain access to their systems but also to prevent sensitive data from being released. The report notes that in 74% of ransomware attacks, data encryption occurred, and 66% of healthcare organizations saw their backups compromised, forcing many to pay the ransom to recover their data.
Ransom payments in the healthcare sector have also surged. In 2024, the median ransom payment was $1.5 million, with some organizations paying an average of $4.4 million. Interestingly, only 15% of healthcare organizations paid the initial ransom demand, with 57% paying more than what was initially requested.
The total recovery cost from ransomware attacks, excluding ransom payments, has also increased in 2024, with healthcare organizations paying an average of $2.57 million, up from $1.82 million in 2023. These costs include downtime, personnel time, device replacement, and other expenses related to the attack.
