Healthcare ransomware attacks rise 14% as cybercriminals increasingly target suppliers

Ransomware attacks targeting healthcare organisations around the world increased by almost 14% during the first half of 2026, with new figures showing particularly sharp growth in attacks against businesses supporting the healthcare sector.

Researchers recorded 410 ransomware attacks against healthcare organisations and businesses globally during the first six months of the year, compared with 360 during the second half of 2025. The figures, compiled by technology research company Comparitech, suggest healthcare continues to be one of the sectors facing significant exposure to ransomware and data theft.

However, the increase was not driven primarily by attacks against hospitals and clinics. Of the 410 incidents recorded, 247 involved hospitals, clinics and other direct healthcare providers, representing an increase of around 3% compared with the previous six months. A further 163 attacks affected healthcare businesses including pharmaceutical companies, medical device manufacturers, medical billing organisations and health technology businesses.

Attacks against these healthcare businesses increased by almost 35% compared with the second half of 2025, suggesting cybercriminals are increasingly targeting organisations throughout the wider healthcare supply chain rather than concentrating solely on hospitals and frontline providers.

The United States recorded the largest number of attacks, accounting for 225 of the 410 incidents identified globally during the first half of the year. More than half of the ransomware activity recorded in the healthcare sector was therefore associated with US organisations.

The latest figures follow continued warnings about the vulnerability of healthcare infrastructure to cybercrime. Data published by the FBI showed that healthcare and public health was the most targeted US critical infrastructure sector for reported cyber threats during 2025. The sector experienced 460 ransomware attacks and 182 data breaches during the year, resulting in 642 reported cyber incidents.

The American Hospital Association has warned that attacks on healthcare organisations can have consequences extending far beyond the loss of data. Hospitals depend heavily on interconnected digital systems for areas including patient records, diagnostic services, pharmacy operations, laboratory results, communications, billing and the management of clinical care.

When those systems become unavailable, the effects can quickly reach patients. Previous major healthcare cyberattacks have resulted in disrupted clinical services, delays to treatment and difficulties processing payments and authorisations.

The growing focus on healthcare suppliers also creates an additional challenge. Modern health systems depend on extensive networks of technology companies, pharmaceutical businesses, medical device manufacturers, laboratories, payment providers and other third parties. A successful attack against one organisation can therefore potentially disrupt multiple healthcare providers which rely on its systems or services.

The 2024 attack against Change Healthcare demonstrated the scale of disruption that can follow an incident affecting a major healthcare intermediary. An American Hospital Association survey conducted following the attack found that 74% of responding hospitals reported an impact on patient care, while 94% said the incident had affected them financially.

Healthcare organisations also hold large quantities of highly sensitive information, including medical histories, personal identifiers, insurance information and financial data. This can make stolen healthcare information particularly valuable to criminals and gives ransomware groups additional leverage when attempting to extort organisations following a breach.

The threat is no longer limited to criminals simply encrypting an organisation’s computer systems and demanding payment for their restoration. Modern ransomware attacks frequently involve the theft of large volumes of information before systems are encrypted, allowing attackers to threaten to publish sensitive data if their demands are not met.

The latest figures suggest that protecting hospitals alone will therefore not be enough to address the growing threat. Cyber resilience across healthcare increasingly depends on the security of the entire network of businesses and technology providers supporting patient care.

With 410 attacks recorded globally in just six months – an average of more than two every day – ransomware remains a significant operational risk for healthcare organisations. The particularly sharp increase in attacks against healthcare businesses also suggests that organisations throughout the supply chain are becoming an increasingly important target for cybercriminals.

Stay informed with the stories shaping health and social care.