// 01Executive summary
Ransomware poses an urgent and increasing threat to the healthcare sector, exploited by both state-affiliated and cybercriminal groups, including those from Russia, Iran, China, and North Korea. Healthcare organizations are prime targets due to their reliance on legacy systems, weak cybersecurity baselines, and sensitive patient data. Organizations should prioritize strengthening cyber resilience, patching vulnerabilities, and enhancing detection capabilities to counter these sophisticated attacks. Be particularly vigilant against ransomware-as-a-service operations, especially those with Russian affiliations, to protect critical infrastructure and patient care. Immediate actions should focus on vulnerability management and incident response planning specific to ransomware. This threat has significant implications for public health, safety, and national security.
// 02Key metrics
// ttps
1
ATT&CK techniques
// iocs
354
indicators
// actors
0
threat groups
// kwords
10
keywords
// 03MITRE ATT&CK
// 04Threat actors
// no actors matched
// 05Indicators of compromise
// ips0
none
// domains271
- craigd.albert
- thehealthcaresector.state
- signalingadeepeningcybersecuritycrisis.healthcareremainsa
- andtheneedtomaintaincontinuityofcare.large
- healthandsafety.thispaperintroducescyberhealthsecuritytheory
- humansecurityintothecyberdomain.itpositsthattheintegrityofhealthsystems
- careisfoundationaltonationalsecurity.attacksonhealthcareinfrastructurearedirectassaults
- andstrategicpower.drawingonthreecasestudiesandrelatedmitigationstrategies
- theu.s.militaryacademy
- theu.s.government
- unlessotherwisestated.asanopenaccessjournal
- deniabilitytomaintainstrategicadvantagewithminimalrisk.exertingpressureonstatesby
- andnorthkorea.russianransomware
- andblackcatarethemainsourceofransomwareattacksagainstu.s.healthcareorganizations
- state-backedactorshavepersistentlytargetedu.s.criticalinfrastructure
- anddefacingsystemswithpoliticalmessages.theseattackshighlighttheurgentneedfor
- thispaperexaminesthegrowingthreatofransomwareattacksagainstu.s.criticalhealth
- u.s.resiliency
- spacebypresentingacaseforcyberhealthsecuritytheory.thefirstsectionofthepaper
- nationalsecurity.thesecondsectiondetailstheactors
- securitylens.thethirdsectionillustratesindividualandnationalharmposedbytheseattacks
- andconceptionsreproductiveassociates.thepaperconcludeswithadiscussionandasetof
- p.pavlovaandc.d.albert
- dependontheessentialservicesitprovides.thus
- andfederallevels.toassesshowattacksonhealthinfrastructurejeopardize
- resilienceisnotjustthecapacitytowithstand.itistheabilitytofightthrough
- andtopreservefreedomofactionwhenitmattersmost.inanera
- sindispensablepartner.withoutit
- powerisbuiltonanunstablefoundation.withit
- andlogisticaloperations.cisadefines
- nationwideconsequences.attacksonhospitals
- domain.specifically
- andnationalsecurity.withinthisframework
- andsocietyremainunder-investigated.whileseveralreportshave
- situatingthemwithinbroadernationalsecurityconcerns.in
- attacksasanationalsecuritypriority.theframingoffersanovelcontributiontothefield
- nationalsecuritystrategies.thefollowingsectionexaminesthena
- tureandextentoftheharmsresultingfromransomwareattackstargetingu.s.healthcare
- ransomwareattacksonu.s.healthcareinfrastructure
- haveintensifiedinfrequency.according
- increasecomparedto2023.thejointcybersecurityadvisory
- ransomwareattackshaveevolvedinsophisticationovertheyears.maliciousactorsoperate
- prominentlyunderraas.thismodelinvolvescollaborationbetween
- healthcareandemergencyservicesareamongthemosttargetedsectors.theu.s.federal
- low-resistancetarget.medicalfacilitiesandservices
- havebeentreatedassecondaryconcerns.thesector
- outdatedsoftwareintroducesadditionalvulnerabilities.third
- inthehealthcaresupplychainfurtherincreasevulnerabilitypoints.theattackersemploy
- combinepoliticalandideologicalmotives.forinstance
- attacksonnumerousu.s.healthcarefacilities
- u.s.officialsalsoobservedclose
- theseoperationsweakenu.s.economicand
- societalresilienceandserveadversarialinterests.researchindicatesthatrussianintelligence
- includinghealthcarefacilities.mostoftheseattackshavebeendirectedattheu.s.andsouth
- theu.s.departmentofjusticeindictednorthkoreannationalrim
- jonghyokforconspiracytocommitcomputerhackingandmoneylaundering.believedtobe
- andresistransompayments.originallyfocusedonencryptingvictims
- organizationstopayransom.suchattacksclearlymeettheconditionstoconstituteathreatto
- tonationalsecurity.bydisruptingmedicalcare
- risktotheorganization.thesensitivityofhealthinformationincreasesthevalueofstolen
- pressuringorganizationstopaytopreventexposure.whenpublictrust
- andharmingbothmedicalstaffandpatients.thesecumulative
- cietal.thiscaninformcountriesoncost
- includingindirectorsecondaryeffects.similarly
- internationalpeaceandsecurity.assessingthefullextentandsequenceofharmsremains
- tieredcausality.therefore
- impactsofransomwareattacksagainsthealthcare.suchanalysisenablesmappingthelevel
- theanalysisappliesastructuredcodingschemeandharmtaxonomy.thecodingscheme
- aunitedhealthgroup-ownedu.s.companyprovidingrevenueandpay
- andpatients.on
- alphv.thisrussian
- theu.s.departmentofstatelaterofferedrewardsofupto
- ofafailuretocomplywiththehipaasecurityrulestandards.theattackforcedchange
- sector.disruptionsaffectedbillingsystems
- andgovernmentidentifiers.unitedhealthstatedthatithadnotidentifiedevidenceofactive
- theu.s.healthcaresysteminhistory
- ofvulnerability.atthecommunitylevel
- acrosstheentirehealthcareecosystem.fromahealth
- disruptionsacrossu.s.hospitalsandproviders
- sufferedamajorcyber-attackin2024.theintrusionbeganon
- erationsacrosssixstatesupondetection.theblackbastaraasgroupwasidentifiedasthe
- perpetrator.thecybercriminalgangusesaggressivedoubleextortiontactics
- indiscriminateapproach.itstacticsleverage
- ajointu.s.cybersecurityadvisorywarned
- multiplefacilitieslostaccesstoelectronicrecordsforweeks.anurseinmichiganreported
- technologytopreventpotentiallyfatalmistakes.atascensionst.johnhospitalindetroit
- andgovernmentidentifiers.on
- thefinancialconsequencesfortheproviderweresubstantial.theattackcauseddelays
- andpaymentprocessing.forthefiscalyearending
- insecurityacrossmultiplelevels.attheindividuallevel
- reducedpatientcapacity.thisalignswithdavies
- turalfragilityofalargeu.s.healthcarenetwork
- ransompayments.thegrouphasbeenlinkedtotheexploitationofacriticalcitrixnetscaler
- ticularlyseriousrisks.exposureofsuchinformationcancauselong
- personaldomainsofhealthsecurity.attheindividuallevel
- wheregovernanceandresilienceareequallycriticalashazardresponse.inthis
- cerns.fiverecurringpatternsemergeacrosscases
- andgovernanceandresiliencefactors.vulnerability
- cascadingeffects.theremainingfactorstrackescalationfromtechnicalfailurestooperational
- anderosionofinstitutionaltrust.together
- magnifiedtheconsequencesofattack.changehealthcaredemonstratedthedangersofsys
- singlepointoffailureforclaimsandbillingacrosstheu.s.healthcareeconomy.ascension
- sixstate-widehospitalnetworks.conceptionsreproductiveassociates
- oversightenabledarelativelysmallbreachtoproducepsychosocialharm.acrosscases
- theirobjectivesandescalationlogicsdiverged.blackcat
- throughsheerscale.blackbastaaimedforhighoperationaldisruption
- societalsalience.thetargetingofhealthcare
- harmseverity.changehealthcaredetectedtheintrusionninedaysafterinitialcompromise
- risk.conceptionsidentifiedtheincidentwithinweeksbutdelayedpublicnotificationforsix
- compoundingregulatoryexposureandcommunitymistrust.acrosscases
- provedcentral.eachdelay
- andpsychosocialtraumainconceptions.thus
- dominantharmtypediffered.changehealthcareproducedeconomicandsystemicharm
- andexposureof190millioncitizens.ascension
- 1.4billioninlosses.conceptionsgenerated
- magnifiedbythegenderednatureofthedata.thesevariationsconfirmthatransomwareisa
- multidimensionalsecurityhazard.technicalbreachesquicklycascadeintoorganizational
- andpublicpressure.the
- butonorganizationaladaptabilityandhumancoordination.effectivecyberhealthsecurity
- concerns.technicalvulnerabilitiesandgovernancegapsinteractwithoperationaldependen
- anddatasensitivitytogeneratecascadingharm.whenhealthcaresystems
- insecurity.buildingontheseempiricalinsights
- context.together
- similartoenergyandfinancialsectors.thisalignswiththewho
- andprioritizedprotection.cybersecuritymustbereframedasacondition
- mancegoals.promptcyberincidentreportingandinformationsharingmustbemandatory
- u.s.congress
- offersacompellingprecedent.cisa
- theu.s.shouldadoptsimilar
- strategies.incidentclassificationshouldaccountforphysical
- fornational-levelresponsestolarge-scalecyberdisruptions.whentriggered
- maintainingessentialcareamidcyberdisruption.mea
- surementmustalsoevolve.existingreportingsystemsstillfocusnarrowlyonfinancialloss
- theu.s.shouldreinforceglobalcooperation
- gies.data
- andincidentresponseplanning.standard
- upfollowinganydata-relatedtransaction.organizationsshouldidentifytheir
- securityimperative.theorderputsaclearrequirementontheprivatesectortocloselyknow
- theirdataandthenatureofitssensitivity.werecommendfollowingtheseguidelinesand
- vrandai-assistedtelehealth.cybersecu
- notacompliancecheckbox.leadership
- tolimitsystemicvulnerabilities.these
- dependingontheserviceaffected.victimsofhealthcaredatabreachesexperience
- areexposedtogether.oncebreached
- researchintocascadingeffects.organizationsmustdeterminehowfardownstreamtoassess
- termrelianceontheprovidedservicesispronounced.greater
- harmduringcrises.underhipaa
- individuals.moreproactive
- increaseresilienceagainstaggressiveransomwaretactics.measurementmustevolvebeyond
- patientsandstaff.sucharegistryalignswiththerusiframework
- forprivatesectoractorsinhealthtechmustbecreated.incentivizingresilienceinvestments
- planning.akeyelementwouldrequiremajormedicalsupplierstoreportcybervulnerabil
- thatleadstopatientharmorserviceinterruptions.finally
- workinggroups.apublic
- defenses.policiesoftenlackstandardization
- paymentsuccess.regularreviewofcyberinsurancepoliciesandstatesupportforuncovered
- infrastructureiscrucialasthreatsevolve.incidentclassificationshouldaccountforphysical
- andthenation.byembeddinghealthcareinfrastructurewithinthenationalsecurity
- cybersecurityisinseparablefromnationalsecurity.theu.s.faceschallengesindefending
- influence.cyberthreatsintensify
- vidualandcommunitywell-being.adversarialstatesandcybercriminalsincreasinglyexploit
- theu.s.mustadapttochangingcircumstances
- itymeasures.acollectivedefenseofhealthcare
- shouldbeembeddedwithinacoherentcyberhealthsecuritystrategy.thisway
- andtheeuropeanparliament.pavlovahasbeenattheforefrontof
- advancingstakeholderinputintotreatyimplementation.shewasafellow
- dr.craigdouglasalbertisaprofessorofpoliticalscienceandgraduatedirectorofthephdinintelligence
- earnedhisphdfromtheuniversityofconnecticutin2009.hisresearchfocusesoninternationalsecurity
- andpoliticalphilosophy.dr.albertis
- amongothers.hehastestifiedbeforetheu.s.congressandcontributedexpert
- andforbes.hehas
- theauthorswanttothanktheeditorsandreviewersatcdr.theeditorialteamwasanincredibleassettothis
- manuscriptgettingpublished.dr.albertwouldalsoliketothankchrisforde
- aph.d.studentinhisprogram
- forhisassistance.theauthorsalsobenefitedfromandwouldliketothanktheparticipantsandorganizersof
- 1321485.https
- 2025.https
- andjasonr.c.nurse
- 2056-4961.https
- jasonr.c.nurse
- tyy006.https
- 2024.https
- breach-impacting-56.html
- 375.https
- ady.2025.ransomwareannualreport2024.technicalreport
- breachsense.n.d.incransom.breachsense
- owaind.williams
- 127.https
- maryc.waters
- eds.2018.theartandscienceofsocialresearch.newyork
- w.w.norton
- centersfordiseasecontrolandprevention.2024.globalhealthsecurity.cdc.https
- global-health-security.html
- 2024.cyberincidentreportingforcriticalinfrastructureact
- actorstargetingnetworkinfrastructuredevices.cybersecurityadvisory
- 2022.https
- 2024b.nationalsecuritymemorandumoncritical
- infrastructuresecurityandresilience.cisa.https
- cisa.https
- healthcareandpublichealthsector.https
- february.https
- 2020.ransomwareactivitytargetingthehealthcareandpublic
- 2020.https
- cmitsolutions.n.d.anotherday
- anotherdatabreach.cmitsolutionsblog
- cyberpeaceinstitute.2022.compendiumofmultistakeholderperspectives.cyberpeaceinstitute
- july.https
- cyberpeaceinstitute.2024.harmmethodology.https
- sarae.2008.globalpoliticsofhealth.cambridge
- stefan.2010.securityandglobalhealth.cambridge
- 2024.preventingaccesstoamericans
- 856.https
- law.indiana.edu
- emilyo.goldman
- andrichardj.harknett.2022.cyberpersistencetheory
- nationalsecurityincyberspace.oxford
- 2023.https
- healthcareitnews.com
- 114.https
- 348.https
- health-isac.2025.2025healthsectorcyberthreatlandscape.technicalreport.february2025.https
- isac.org
- u.s.departmentofhealthandhumanservices
- 2023.breachnotificationrule
- index.html
- urity.com
- e006520.https
- 732.https
- alexander.ransomwaregangleaksstolenscottishhealthcarepatientdatainextortionbid
- anddennise.leber
- editedbyjohnt.finnellandbriane.dixon
- 253.springerinternationalpublishing.https
- 23.https
- microsoft.2022.microsoftdigitaldefensereport2022.microsoftcorporation.https
- ahmedj.obaid
- 1788.ieee.https
- rebecca.2025.healthcareransomwareroundup
- nccgroup.com
- andshelbygrossman.2023.assessingthepoliticalmotivationsbehindransomwareattacks
- papers.cfm
- 2019.cyberresilience
- glossaryandframework.nist
- computersecurityresourcecenter.https
- evilcorp.reportno
- u.s.department
- inc.databreachinvestigation
- anda.selcukuluagac
- 37.https
- pavlina.2025.enhancingcyberresilienceforequitablehealthcare
- sexualandreproductivefacilitiesandservices.ucberkeleycenterforlong
- 81.https
- 796.https
- 4483.https
- sbsnews.2024.albanesesaysmedisecurehack
- tbethelast.onlinenews
- 12.https
- thewhitehouseofficeofthepresssecretary.2013.presidentialpolicydirective
- andresilience.thewhitehouse
- 2013.https
- u.s.departmentofthetreasury.2019.treasurysanctionsevilcorp
- dridexmalware.pressrelease
- 2019.https
- u.s.departmentofthetreasury
- vectraai.n.d.incransom.vectraaithreatactorprofile.https
- 1110.https
- 2018.essentialpublichealthfunctions
- developingconceptualclarityandawhoroadmapforaction.worldhealthorganization.https
- who.int
- josephine.2024.insurerswillhelpdefinethethresholdforcyberwar.bindinghook
- bindinghook.com
- 374.https
// urls83
- https://doi.org/10.55682/cdr/8esp-2b06
- https://doi.org/10.3389/fdgth.2024.1321485
- https://doi.org/10
- https://doi.org/10.1145/3676283
- https://doi.org/10.1093/cybsec/tyy006
- https://www.techspot.com/news/106119-employee-error-blameascension-data-
- https://doi.org/10.1017/pls.2021.1
- https://www.hipaajournal.com/ascension-cyberattack-2024/
- https://www.hipaajournal.com/black-basta-ransomware-healthcare/
- https://www.hipaajournal.com/center-for-vein-restoration-data-breach/
- https://www.hipaajournal.com/connectoncall-data-breach/
- https://www.hipaajournal.com/mclaren-health-care-investigating-potential-
- https://www.hipaajournal.com/change-healthcare-responding-to-
- https://doi.org/10.1093/heapol/czn030
- https://www.aha.org/news/headline/2025-05-12-report-health-care-had-most-reported-
- https://www.csis.org/analysis/deterrence-under-pressure-sustaining-us-rok-cyber-
- https://www.bbc
- https://cyberint.com/
- https://www.breachsense.com/
- https://doi.org/10.1186/s12992-022-00840-6
- https://markets.businessinsider.com/news/stocks/conceptions-
- https://www.jstor
- https://www.cdc.gov/global-
- https://www.pchne.org/wp-content/uploads/
- https://www.federalregister.gov/documents/2024/04/04/2024-06526/cyber-incident-reporting-for-
- https://www.cisa
- https://cmitsolutions.com/blog/another-week-another-healthcare-breach/
- https://news.bloomberglaw.com/litigation/colorado-fertility-clinic-sued-over-data-breach-affecting-
- https://cyberpeaceinstitute.org/harm-methodology/
- https://www.propublica
- https://www.federalregister.gov/documents/2024/03/01/2024-04434/preventing-access-
- https://www.repository
- https://flashpoint.io/blog/understanding-black-basta-ransomware/
- https://www
- https://natlawreview.com/article/ascension-health-notifying-56-million-data-breach
- https://doi.org/10.1177/20438869241258235
- https://therecord.media/nearly-six-million-affected-ransomware
- https://doi.org/10.55682/cdr/egvf-mkys
- https://doi.org/10.1177/
- https://health-
- https://files.asprtracie.hhs.gov/documents/aspr-tracie-healthcare-system-
- https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
- https://rusi.org/explore-our-research/publications/commentary/ransomware-life-and-
- https://krebsonsec
- https://www.fiercehealthcare.com/health-tech/us-indicts-north-korean-hacker-leading-
- https://static.rusi.org/ransomware-harms-op-january-2024.pdf
- https://doi.org/10.1136/bmjgh-2021-006520
- https://doi.org/10.51219/JAIMLD/Srikanth-mandru/182
- https://therecord.media/ransomware-lehigh-valley-alphv-black-cat
- https://therecord.media/healthcare-ransomware-data-
- https://doi.org/10.1017/S0260210506006905
- https://cdn-dynmedia-1.microsoft
- https://doi.org/10.1109/ICCES56750.2023.10149916
- https://www.comparitech.com/news/healthcare-ransomware-roundup-h1-
- https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4507111
- https://www.hhs.gov/sites/default/files/evil-corp-threat-
- https://classlawdc.com/2024/12/19/conceptions-reproductive-associates-of-
- https://doi.org/10.1145/
- https://www.newamerica
- https://cltc.berkeley.edu/publication/enhancing-cyber-resilience-for-equitable-sexual-reproducti
- https://www.federmanlaw.com/blog/federman-sherwood-
- https://doi.org/
- https://www.npr.org/2024/06/19/nx-s1-5010219/ascension-hospital-
- https://industrialcyber.co/reports/doj-audit-finds-cisa-faces-
- https://doi.org/10.1111/j.1467-9248.2011.00919.x
- https://doi.org/10.1080/10447318.2023.2219964
- https://www.sbs.com.au/news/article/albanese-says-medisecure-hack-very-
- https://doi.org/10.1080/17441692.2019.1634119
- https://www.freep.com/story/news/health/2024/05/21/ascensionhospital-
- https://doi.org/10.1002/gch2.201700003
- https://straussborrelli.com/2024/12/18/conceptions-reproductive-associates-of-
- https://obamawhitehouse.archives.gov/the-press-
- https://home.treasury.gov/news/press-releases/sm845
- https://home.treasury.gov/news/press-
- https://cyberscoop.com/information-sharing-china-threat/
- https://www.vectra.ai/modern-attack/threat-
- https://www.cybersecuritydive.com/news/ascension-reduces-operating-cyber-attack/734580/
- https://doi.org/10.1093/ia/iiz170
- https://iris
- https://www.who.int/news/item/19-09-2024-20240920-health-practitioner-
- https://www.queensu.ca/cidp/
- https://doi.org/10.1146/annurev-publhealth-031914-122829
- https://www.theatlantic.com/
// sha2560
none
// md50
none
// emails1
- calbert@augusta.edu
// cves0
none
// 06Geographic coverage
// 07YARA rule
// Failed to generate YARA rule
// 08Keywords
{'keyword': '2024', 'score': 48.9887}
{'keyword': '2025', 'score': 24.577}
{'keyword': 'ransomware', 'score': 16.0094}
{'keyword': 'thecyberdefensereview', 'score': 14.5885}
{'keyword': 'albert', 'score': 14.0661}
{'keyword': 'com', 'score': 13.9204}
{'keyword': 'health', 'score': 13.5302}
{'keyword': 'data', 'score': 12.3863}
{'keyword': 'security', 'score': 12.2211}
{'keyword': 'healthcare', 'score': 11.8282}