Blog

Ransomware news & analysis

Threat intelligence and analysis for healthcare security leaders — the active groups, the attack trends, the medical-device blind spot, and what it all means for keeping a hospital running through an attack.

Threat Intelligence28 Aug 2026 · 6 min read

The ransomware group shakeup: what Qilin's rise means for hospitals

RansomHub went dark, LockBit was disrupted — and their affiliates didn't retire. They regrouped under new brands like Qilin, and healthcare is squarely in the blast radius.

Read the article →

Latest analysis

#Qilin#RansomHub#threat actors#healthcare

All articles

Recent posts

Industry Analysis

Healthcare ransomware by the numbers: what 2025 and early 2026 tell us

Attacks on healthcare stayed near record highs, breaches hit an all-time peak, and fewer victims paid. Here's what the latest data means for hospital security leaders.

14 Aug 2026 · 5 minRead →

Is a ransomware attack a HIPAA breach?

Short answer: usually yes. Federal guidance treats ransomware on systems holding electronic PHI as a presumed breach unless you can prove otherwise. Here's what that means for hospitals.

31 Jul 2026 · 6 minRead →

Medical Device Security

The medical-device blind spot: why IoMT is ransomware's easiest way in

Nearly every hospital runs connected medical devices with known-exploited vulnerabilities — and most can't run a security agent. That gap is exactly where modern attacks begin.

30 Jul 2026 · 6 minRead →

Defense & How-To

How to prevent ransomware in a hospital: a practical playbook

Prevention alone will never be perfect in a hospital — but a layered program that assumes breach and prioritizes resilience changes the odds dramatically. Here's the playbook.

17 Jul 2026 · 8 minRead →

Incident Analysis

When ransomware becomes a patient-safety event

A February 2026 attack forced a major US medical center back to paper and delayed chemotherapy. It's the clearest sign yet that attackers now weaponize disruption itself.

16 Jul 2026 · 5 minRead →

Defense & How-To

Immutable backups explained: your last line against ransomware

Attackers now hunt your backups first. Immutable, air-gapped recovery points are what stand between a bad day and a paid ransom — if they're done right.

03 Jul 2026 · 6 minRead →

EDR vs. ransomware resilience: why detection isn't enough

Endpoint detection is essential — and insufficient on its own for hospitals. Here's the gap it leaves, and why resilience is the layer that keeps care running through an attack.

19 Jun 2026 · 6 minRead →

Defense & How-To

Building a ransomware incident response plan for healthcare

When ransomware hits, the first hour decides the next month. A healthcare-specific incident response plan — rehearsed, not just written — is what turns chaos into a controlled response.

05 Jun 2026 · 7 minRead →

Defense & How-To

Detecting ransomware before encryption: the early-warning signals

By the time files start encrypting, you've already lost. The window that matters is the quiet period before — and it leaves signals a resilient platform is built to catch.

22 May 2026 · 6 minRead →

Stay ahead of the next ransomware attack

See how Immune turns the threats in these articles into a hospital that keeps running — detect, contain, and self-heal.

Request a Demo Explore the platform

Talk to us

See Immune protect your organization

Tell us about your environment and our team will show you exactly how Immune detects, contains, and self-heals through a ransomware attack — including the connected devices your current tools can't reach. We respond within one business day.

A working demo on a realistic scenario
Agentless coverage for medical and connected devices
On-premises and data-sovereignty deployment options
A frank look at where Immune fits alongside your stack