Healthcare Ransomware Risks and the Case for Early Detection

Summary

The article describes ransomware’s risks to healthcare, including disrupted care and stolen patient data, and promotes layered defenses and managed EDR. A Huntress SOC isolated a client server before ransomware spread; a late response at another practice followed data.

Key points

The article says ransomware can disrupt healthcare operations and patient care, and cites the 2023 Ardent Health Services attack as an example in which ambulances were rerouted.
It reports that phishing can provide an entry point and that attackers may encrypt files and steal protected health information.
The article notes that paying a ransom does not guarantee recovery, citing a report that fewer than 65% of data was restored on average among healthcare organizations that paid in 2021.
It recommends defense in depth, including intrusion prevention, encryption, and threat detection, and highlights managed endpoint detection and response (EDR).
In one account, a managed service provider’s client server was isolated by Huntress’s SOC after ransomware was detected, preventing further spread; the client was operating again the next day.
A separate physician’s office reportedly deployed protection only after a ransomware attack, by which time personal, financial, and patient data had been stolen and offered for sale.