--- title: Healthcare’s Ransomware Crisis - ClearDATA description: Ransomware Continues to Evolve It's no secret that every industry faces prolific ransomware attacks. New ransomware culprits emerge and regularly join the --- [Log in to the CyberHealth™ Platform](http://cyberhealth.cleardata.com/) [Talk to a Cloud Expert](https://www.cleardata.com/consultation/) [![Clear data](https://cspm.cleardata.com/hubfs/Cleardata_February2025/images/cleardata-logo.svg)](https://www.cleardata.com/) - [CSPM for Healthcare](https://www.cleardata.com/cspm) - - [Safeguards: HIPAA, HITRUST, GDPR, ISO, NIST, PCI](https://www.cleardata.com/cspm/#cspm-features) - [Automated Compliance](https://www.cleardata.com/cspm/#cspm-features) - [Cloud Risk Identification & Remediation](https://www.cleardata.com/cspm/#cspm-features) - [Compliance Risk Scores](https://www.cleardata.com/cspm/#cspm-features) - [PHI Leak Discovery](https://www.cleardata.com/cspm/#cspm-features) - [Audit-Ready Reporting](https://www.cleardata.com/cspm/#cspm-features) - Services - Managed Services - [Cloud Compliance](https://www.cleardata.com/cloud-compliance/) - [Managed Detection & Response](https://www.cleardata.com/cspm/managed-detection-and-response/) - [Cloud Operations](https://www.cleardata.com/cspm/cloud-operations/) - [Professional Services](https://www.cleardata.com/cspm/cloud-transformation/) - [Cloud Migration & Modernization](https://www.cleardata.com/cspm/cloud-transformation/#migration) - [Cloud Assessments](https://www.cleardata.com/cspm/cloud-transformation/#assessments) - [End-to-End Cloud Resilience](https://www.cleardata.com/cspm/cloud-transformation/#end2end) - Solutions - By Market - [Healthcare Software & Services](https://www.cleardata.com/solutions-by-market/healthcare-software-services/) - [Medical Devices & Equipment](https://www.cleardata.com/solutions-by-market/medical-devices-equipment/) - [Healthcare Providers](https://www.cleardata.com/solutions-by-market/medical-devices-equipment/) - [Healthcare Payers](https://www.cleardata.com/solutions-by-market/healthcare-payers/) - By Topic - - [Risk Visualization & Prioritization](https://www.cleardata.com/risk-visualization-prioritization/) - [Threat Detection & Protection](https://www.cleardata.com/security-threat-protection/) - [Cost & Performance Optimization](https://www.cleardata.com/cost-performance-optimization/) - [Healthcare Cloud Compliance](https://www.cleardata.com/healthcare-cloud-compliance/) - [Analytics & Reporting](https://www.cleardata.com/analytics-reporting/) - [GxP for Life Sciences](https://www.cleardata.com/gxp-life-sciences/) - [EHR Deployments in the Cloud](https://www.cleardata.com/ehr-cloud-deployments/) - Resources - - [View All](https://www.cleardata.com/resources/) - [Blog](https://www.cleardata.com/blog/) - [What Is Compliance Debt?](https://www.cleardata.com/blog/eliminating-compliance-debt-the-key-to-healthcare-tech-innovation/) - [Customer Stories](https://www.cleardata.com/stories/) - [Events](https://www.cleardata.com/events/) - [About](https://www.cleardata.com/about-us/) - - [Leadership Team](https://www.cleardata.com/about-us/leadership-team/) - [Careers](https://www.cleardata.com/about-us/careers/) - [News](https://www.cleardata.com/about-us/news/) - [Partners](https://www.cleardata.com/supported-clouds/) - [CSPM for Healthcare](https://www.cleardata.com/cspm) - - [Safeguards: HIPAA, HITRUST, GDPR, ISO, NIST, PCI](https://www.cleardata.com/cspm/#cspm-features) - [Automated Compliance](https://www.cleardata.com/cspm/#cspm-features) - [Cloud Risk Identification & Remediation](https://www.cleardata.com/cspm/#cspm-features) - [Compliance Risk Scores](https://www.cleardata.com/cspm/#cspm-features) - [PHI Leak Discovery](https://www.cleardata.com/cspm/#cspm-features) - [Audit-Ready Reporting](https://www.cleardata.com/cspm/#cspm-features) - Services - Managed Services - [Cloud Compliance](https://www.cleardata.com/cloud-compliance/) - [Managed Detection & Response](https://www.cleardata.com/cspm/managed-detection-and-response/) - [Cloud Operations](https://www.cleardata.com/cspm/cloud-operations/) - [Professional Services](https://www.cleardata.com/cspm/cloud-transformation/) - [Cloud Migration & Modernization](https://www.cleardata.com/cspm/cloud-transformation/#migration) - [Cloud Assessments](https://www.cleardata.com/cspm/cloud-transformation/#assessments) - [End-to-End Cloud Resilience](https://www.cleardata.com/cspm/cloud-transformation/#end2end) - Solutions - By Market - [Healthcare Software & Services](https://www.cleardata.com/solutions-by-market/healthcare-software-services/) - [Medical Devices & Equipment](https://www.cleardata.com/solutions-by-market/medical-devices-equipment/) - [Healthcare Providers](https://www.cleardata.com/solutions-by-market/medical-devices-equipment/) - [Healthcare Payers](https://www.cleardata.com/solutions-by-market/healthcare-payers/) - By Topic - - [Risk Visualization & Prioritization](https://www.cleardata.com/risk-visualization-prioritization/) - [Threat Detection & Protection](https://www.cleardata.com/security-threat-protection/) - [Cost & Performance Optimization](https://www.cleardata.com/cost-performance-optimization/) - [Healthcare Cloud Compliance](https://www.cleardata.com/healthcare-cloud-compliance/) - [Analytics & Reporting](https://www.cleardata.com/analytics-reporting/) - [GxP for Life Sciences](https://www.cleardata.com/gxp-life-sciences/) - [EHR Deployments in the Cloud](https://www.cleardata.com/ehr-cloud-deployments/) - Resources - - [View All](https://www.cleardata.com/resources/) - [Blog](https://www.cleardata.com/blog/) - [What Is Compliance Debt?](https://www.cleardata.com/blog/eliminating-compliance-debt-the-key-to-healthcare-tech-innovation/) - [Customer Stories](https://www.cleardata.com/stories/) - [Events](https://www.cleardata.com/events/) - [About](https://www.cleardata.com/about-us/) - - [Leadership Team](https://www.cleardata.com/about-us/leadership-team/) - [Careers](https://www.cleardata.com/about-us/careers/) - [News](https://www.cleardata.com/about-us/news/) - [Partners](https://www.cleardata.com/supported-clouds/) # Healthcare’s Ransomware Crisis February 16, 2022 4 minute read [mailto:?body=https://cspm.cleardata.com/cleardata-blog/blog/healthcares-ransomware-crisis](mailto:?body=https://cspm.cleardata.com/cleardata-blog/blog/healthcares-ransomware-crisis) ### [![2024-Threat-Report-data-1](https://cspm.cleardata.com/hubfs/Cleardata_February2025/images/2024-Threat-Report-data-1.jpg) Guide 2024 Healthcare Threat Report Learn More](https://www.cleardata.com/resources/healthcare-threat-report/) #### Table of Contents ### Ransomware Continues to Evolve It’s no secret that every industry faces prolific ransomware attacks. New ransomware culprits emerge and regularly join the over [1,000 ransomware groups](https://id-ransomware.malwarehunterteam.com/) worldwide. The FBI tracks over [one hundred of those](https://www.nbcnews.com/tech/security/fbi-tracking-100-active-ransomware-groups-rcna1524) groups. Sadly, our hospitals are attacked most, and not coincidentally, the most vulnerable target. According to CyberPeace Institute’s Cyber Incident Tracer, a whopping [39 ransomware groups](https://healthitsecurity.com/news/39-ransomware-groups-targeted-healthcare-in-the-past-18-months) went after healthcare for 18 months. That should alarm every patient and healthcare provider in America. Our inboxes overflow with new warnings about new malware variants designed to destroy your data. In February 2022, for example, government agencies from the US, UK, and Australia issued a [joint warning about increasing attacks](https://www.healthcareinfosecurity.com/cyber-agencies-warn-ransomware-attacks-are-worse-than-ever-a-18497?highlight=true). In October 2021, the [CISA](https://www.cleardata.com/blog/reducing-successful-cyber-attack-vectors/), FBI, and NSA issued a joint alert warning about [BlackMatter ransomware](https://www.healthcareitnews.com/news/hospital-ransomware-attack-led-infants-death-lawsuit-alleges) that affected multiple industries. In October 2020, the FBI, CISA, and HHS warned of [Ryuk ransomware campaign](https://www.infosecurity-magazine.com/news/red-alert-us-hospitals-flooded/) targeting 400 US hospitals. ### **Ransomware in Healthcare** The operational carnage challenged an already burdened healthcare system. The threat to human life due to a lack of information and the astounding recovery costs are catastrophic to healthcare organizations. But the real tragedy is the harm to patient care. In the most disruptive scenario, an attack can effectively shut down the hospital’s entire system. Imagine the surgeries to cancel, ambulances to reroute, and critical patients to transfer to another facility or provider mid-treatment. A ransomware attack completely disrupts the patients’ continuum of care. Even more alarming, ransomware is affecting mortality rates. A recent [Ponemon Institute study](https://www.businesswire.com/news/home/20210922005436/en/New-Ponemon-Institute-Research-Shows-Ransomware-Attacks-on-Healthcare-Delivery-Organizations-Can-Lead-to-Increased-Mortality-Rate) found that ransomware increased the mortality rate by 22%. There are several recent examples where fatalities were directly caused by ransomware attacks: • In September 2020, [a ransomware attack in Germany](https://www.healthcareitnews.com/news/hospital-ransomware-attack-leads-fatality-after-causing-delay-care) destroyed a hospital’s servers, so patients had to relocate to different healthcare provider facilities. The hospital transferred a very critically ill patient to a hospital twenty miles away, resulting in death. • In July 2019, [a ransomware attack disrupted a hospital in Alabama](https://www.nbcnews.com/news/baby-died-due-ransomware-attack-hospital-suit-claims-rcna2465). While a patient was in labor, there was no access to crucial fetal heartbeat monitors. It severely complicated the delivery, and nine months later, the injuries led to the infant’s death. > Ransomware attacks in the healthcare industry are reaching crisis levels. Ransomware was the cause of a [majority of the healthcare breaches in 2021](https://www.healthcareinfosecurity.com/ransomware-incidents-among-largest-breaches-on-federal-tally-a-17846?), affecting about eight million individuals. Organized crime, and in some cases, nation-state actors, reaped substantial payments by taking healthcare networks hostage. More ransomware attacks are guaranteed to happen with each success and ransom paid. While this may sound like a technology problem, and it is, it’s more than that. In healthcare, there are trickle-down effects for everything that happens. Whatever happens with data eventually affects a human being. Knowledge is power when it comes to defending your hospital from ransomware. There are warning signs of ransomware attacks, and attackers leave trails. Gaining insights into detecting intruders and knowing the methods they use to gain access is necessary to stop them before they substantially harm you. ### **The Ransomware Economy** The Ransomware economy is reasonably simple to understand. Economics 101 helps us understand the laws of supply and demand. A hospital needs data, and ransomware gang members need money. But the healthcare provider has both. The ransomware attacker must steal the provider’s data to create an artificial and temporary [market](https://www.cleardata.com/our-solutions/) to force providers to pay money to get their data back and systems online. Preventing the creation of this ransomware market requires that the provider safeguard the data. No data theft means no system disruption, which prevents a ransom demand from ever happening. It is that simple. Unfortunately, preventing data theft and destruction takes a lot of work by a lot of skilled people. Many fail to guard the castle. Like a “normal” business, the ransomware attacker strives to generate consistent revenues leveraging global automation and [cloud services](https://www.cleardata.com/blog/mitigating-software-release-impacts/). The attacker even leverages at-scale [services](https://www.cleardata.com/services-descriptions/) provided by the syndicate, such as “customer support” for attackers to scale and victims struggling to recover from the attack. The ransomware underworld thrives on many dark truths: • Novice criminals can easily buy and use ransomware software. • Profit from attacks is quick and predictable. • There is less [risk](https://www.cleardata.com/risk-visualization-prioritization/) in the payoff than other hacking methods with little or no direct contact with the victim. • The ransomware model comes with a “built-in” buyer of the data meaning the criminal doesn’t have to find a buyer. • Ransomware is rapidly scalable – it can be globally automated. • It is less trackable using cryptocurrency. Those who pay the ransom may think they recovered from the attack but quickly become a “known payer.” Becoming a known payer of ransoms puts a long-term target on the organization and contributes to the cybercriminal economy. For this reason, [the FBI discourages the payment of a ransom.](http://www.ic3.gov/Media/Y2019/PSA191002) ### **How Healthcare Can Combat the Ransomware Crisis** Ransomware attacks occur [every 11 seconds](https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-20-billion-usd-by-2021/)! Healthcare must change its mindset and prepare for when, not IF a cyberattack happens. Many available resources can help your organization prepare for and respond to ransomware. [ClearDATA](https://www.cleardata.com/) has learned a thing or two about preventing ransomware by successfully defending thousands upon thousands of cloud-based healthcare systems. For more guidance on ransomware, download our recent eBook, [“Ransomware Response and Recovery Guide.”](https://www.cleardata.com/ransomware-response-recovery-guide/) [Contact us](https://www.cleardata.com/contact-us/) if you’d like a deeper dive. Secure Your Healthcare Cloud ## Speak with a healthcare cybersecurity and compliance expert today. [Speak with an expert](https://www.cleardata.com/consultation/) ### [![Healthcare Ransomware Attacks: What You Need to Know ](https://cspm.cleardata.com/hubfs/Imported_Blog_Media/AdobeStock_713117510-1.jpg) Blog Healthcare Ransomware Attacks: What You Need to Know ](https://cspm.cleardata.com/cleardata-blog/blog/healthcare-ransomware-attack) ### [![Webinar Offers Ways to Protect Your Organization from Ransomware Attacks](https://cspm.cleardata.com/hubfs/Imported_Blog_Media/jefferson-santos-450403-unsplash-scaled-1-2.jpg) Webinar Offers Ways to Protect Your Organization from Ransomware Attacks](https://cspm.cleardata.com/cleardata-blog/blog/ransomware-protection-webinar) ### [![Cloud Ransomware in Healthcare](https://cspm.cleardata.com/hubfs/Imported_Blog_Media/AdobeStock_506885664-2.jpg) Blog Cloud Ransomware in Healthcare](https://cspm.cleardata.com/cleardata-blog/blog/cloud-ransomware-in-healthcare) [![Clear data](https://cspm.cleardata.com/hubfs/Cleardata_February2025/images/cleardata-logo.svg "Clear data")](https://www.cleardata.com/) - [CSPM for Healthcare](https://www.cleardata.com/cspm) - [Safeguards: HIPAA, HITRUST, GDPR, ISO, NIST, PCI](https://www.cleardata.com/cspm/#cspm-features) - [Automated Compliance](https://www.cleardata.com/cspm/#cspm-features) - [Cloud Risk Identification & Remediation](https://www.cleardata.com/cspm/#cspm-features) - [Compliance Risk Scores](https://www.cleardata.com/cspm/#cspm-features) - [PHI Leak Discovery](https://www.cleardata.com/cspm/#cspm-features) - [Audit-Ready Reporting](https://www.cleardata.com/cspm/#cspm-features) - Services - Managed Services - [Cloud Compliance](https://www.cleardata.com/cloud-compliance/) - [Managed Detection & Response](https://www.cleardata.com/cspm/managed-detection-and-response/) - [Cloud Operations](https://www.cleardata.com/cspm/cloud-operations/) - [Professional Services](https://www.cleardata.com/cspm/cloud-transformation/) - [Cloud Migration & Modernization](https://www.cleardata.com/cspm/cloud-transformation/#migration) - [Cloud Assessments](https://www.cleardata.com/cspm/cloud-transformation/#assessments) - [End-To-End Cloud Resilience](https://www.cleardata.com/cspm/cloud-transformation/#end2end) - Solutions - By Market - [Healthcare Software & Services](https://www.cleardata.com/solutions-by-market/healthcare-software-services/) - [Medical Devices & Equipment](https://www.cleardata.com/solutions-by-market/medical-devices-equipment/) - [Healthcare Providers](https://www.cleardata.com/solutions-by-market/healthcare-providers/) - [Healthcare Payers](https://www.cleardata.com/solutions-by-market/healthcare-payers/) - By Topic - [Risk Visualization & Prioritization](https://www.cleardata.com/risk-visualization-prioritization/) - [Threat Detection & Protection](https://www.cleardata.com/security-threat-protection/) - [Cost & Performance Optimization](https://www.cleardata.com/cost-performance-optimization/) - [Healthcare Cloud Compliance](https://www.cleardata.com/healthcare-cloud-compliance/) - [Analytics & Reporting](https://www.cleardata.com/analytics-reporting/) - [GxP For Life Sciences](https://www.cleardata.com/gxp-life-sciences/) - [EHR Deployments In The Cloud](https://www.cleardata.com/ehr-cloud-deployments/) - Resources - [View All](https://www.cleardata.com/resources) - [Blog](https://www.cleardata.com/blog/) - [What Is Compliance Debt?](https://www.cleardata.com/blog/eliminating-compliance-debt-the-key-to-healthcare-tech-innovation/) - [Events](https://www.cleardata.com/events/) - [Customer Stories](https://www.cleardata.com/cloud-case-studies/) - About - [Leadership Team](https://www.cleardata.com/about-us/leadership-team/) - [Careers](https://www.cleardata.com/about-us/careers/) - [News](https://www.cleardata.com/about-us/news/) - [Cloud Partners](https://www.cleardata.com/supported-clouds) - [Microsoft Azure](https://www.cleardata.com/cspm/microsoft-azure/) - [Amazon Web Services (AWS)](https://www.cleardata.com/cspm/aws/) - [Google Cloud Platform](https://www.cleardata.com/cspm/google-cloud/) © 2026 CLEARDATA All rights reserved - [Privacy Policy](https://www.cleardata.com/legal/privacy-policy) - [Notice of Copyright Infringement](https://www.cleardata.com/legal/notice-of-copyright-infringement) - [Acceptable Use Policy](https://www.cleardata.com/legal/acceptable-use-policy/) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Chris Bowen", "url" : "https://cspm.cleardata.com/cleardata-blog/author/chris-bowen" }, "dateModified" : "2025-09-18T21:09:57.819Z", "datePublished" : "2022-02-16T16:17:32.000Z", "headline" : "Healthcare’s Ransomware Crisis - ClearDATA", "mainEntityOfPage" : { "@id" : "https://cspm.cleardata.com/cleardata-blog/blog/healthcares-ransomware-crisis", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://cspm.cleardata.com/hubfs/ClearDATA-logo-1540.png" } } } ```