For a hospital, ransomware is not only an information-technology incident. When electronic health records, imaging, laboratory orders, pharmacy systems, or phones become unavailable, a cyberattack can alter where ambulances go and how clinicians deliver care. That operational consequence is changing the objective of hospital security. Preventing intrusion remains essential, but resilience now also means sustaining safe clinical work while systems are degraded and restoring the most important services in a deliberate order.
The threat remains persistent. The FBI’s Internet Crime Complaint Center received more than 3,600 ransomware complaints in 2025, with reported direct losses above $32 million. The bureau cautions that the amount generally excludes lost business, downtime, wages, equipment, and third-party remediation, and that not every victim reports. It also found that the ten most frequently reported variants disproportionately affected critical manufacturing, healthcare and public health, and government facilities (FBI). The numbers are therefore a floor, not a full accounting of harm.
The February 2024 attack on Change Healthcare demonstrated how concentrated dependencies can propagate disruption. The company processed transactions connecting insurers, pharmacies, and providers. According to the Government Accountability Office, the attack involved data theft, caused widespread effects on providers and patient care, and generated an estimated $874 million in losses at the time of its November 2024 review (GAO). A hospital can harden its own network and still lose a critical service because a clearinghouse, cloud provider, laboratory, or device vendor is unavailable.
That is why resilience begins with clinical prioritization. CISA’s ransomware guide advises organizations to “Know which data or systems are most critical” and to understand their interdependencies (CISA). In a hospital, this requires more than a generic asset inventory. Leaders must map technology to emergency care, medication administration, surgery, diagnostics, blood supply, scheduling, billing, and communications. Recovery tiers should reflect patient-safety consequences, not simply server ownership or revenue.
Downtime procedures then have to work outside a binder. Staff need current paper forms, read-only access to essential patient information where feasible, alternative ways to identify patients and administer medication, and reliable contact lists. Teams should rehearse multi-day outages that coincide with high census, severe weather, or failure at a regional partner. An exercise should test whether a laboratory result can reach the right clinician and whether transferred patients arrive with usable records—not merely whether a backup can be restored in a test environment.
Technical controls still shape the odds. Phishing-resistant multifactor authentication, prompt patching of internet-facing systems, network segmentation, privileged-access controls, endpoint detection, and protected backups reduce either initial access or an attacker’s ability to move. HHS’s voluntary healthcare-specific Cybersecurity Performance Goals organize high-impact practices into essential and enhanced sets and draw on the NIST Cybersecurity Framework and healthcare guidance (HHS). Because medical devices and legacy applications may be difficult to patch, segmentation and monitoring are especially important compensating controls.
Backups deserve operational scrutiny. Copies should be separated from ordinary credentials, tested for restoration, and aligned with clinical recovery priorities. Restoring an encrypted server is only part of recovery: organizations must validate data integrity, reconnect dependent applications in sequence, reset credentials, and monitor for persistence. Keeping an offline copy without testing how long full restoration takes can create false confidence. So can a plan that assumes the same administrators, vendors, and communication tools will all be available during an incident.
Sector progress is uneven. GAO reported that participating hospitals had self-assessed adoption across 70.7 percent of the NIST Cybersecurity Framework’s identify, protect, detect, respond, and recover functional areas, while finding that HHS had not yet fully tracked ransomware-specific practices in its 2024 review. GAO later recorded steps by HHS to analyze use of its risk-assessment toolkit in 2024 and 2025 (GAO). Measurement matters because a checklist percentage does not reveal whether the missing control protects a low-value workstation or an emergency department dependency.
Boards and regulators consequently need measures tied to care: time to isolate compromised segments, hours to restore medication systems, percentage of critical vendors with tested continuity plans, and frequency of clinical downtime exercises. Smaller and rural hospitals may require shared services, grants, and regional response support rather than unfunded requirements. Resilience is not achieved by treating every asset identically. It comes from combining prevention with rehearsed clinical continuity, redundant dependencies, and recovery decisions made before an extortion clock starts.