When ransomware hits a hospital: what happens to patient data, and how to stop it

A hospital attack is two emergencies at once

When ransomware lands in most businesses, it is a serious operational and financial problem. When it lands in a hospital, it becomes something worse, because two emergencies arrive together. The first is clinical: systems that clinicians rely on to treat patients go dark, so ambulances divert, surgeries and cancer treatments are postponed, and staff fall back to pen and paper. The second is a data breach: the attacker has almost certainly taken a copy of protected health information on the way in, and now threatens to leak it unless paid.

That combination is what makes healthcare the most consequential ransomware target in the world. In 2024, the most-reported category of breach reported to the US Department of Health and Human Services was hacking, and roughly 289 million individuals had their records exposed across about 725 large breaches. In 2025 the breach count set a fresh record at 772. These are not abstract numbers. Behind each one is a hospital that had to choose between paying criminals and leaving patients without the systems that keep them safe.

The incidents that show the pattern

The clearest way to understand the stakes is to look at what has actually happened, because the pattern repeats across very different hospitals.

The Change Healthcare attack is the one that reset everyone's sense of scale. In 2024 the ALPHV/BlackCat group hit the UnitedHealth Group subsidiary that processes a huge share of US medical claims. HHS later confirmed it as the largest healthcare breach on record, with the protected health information of roughly 192.7 million people exposed, and the disruption rippled through pharmacies and providers nationwide for months as claims and payments stalled.

Ascension showed the clinical side of the same coin. In May 2024 a ransomware attack on one of the largest US health systems forced hospitals to divert ambulances and revert to manual operations for weeks, and the incident ultimately affected around 5.5 million people. Capital Health in New Jersey, hit by LockBit in late 2023, spent two weeks in outage, exposed more than 500,000 people, and settled the resulting class action for $4.5 million. And as recently as April 2026, the Anubis group hit Signature Healthcare's Brockton Hospital in Massachusetts, forcing a 'code black,' diverting ambulances, cancelling cancer treatments, and running the hospital on paper for about two weeks while the group claimed to have stolen two terabytes of data.

One more incident is worth remembering because it ended differently. In the summer of 2021, the FBI learned that Iran-sponsored hackers were about to attack Boston Children's Hospital, warned the hospital in time, and the attack was stopped before any damage was done. It is a reminder that these attacks are not only criminal and financial. State-sponsored actors target hospitals too, and early warning plus fast action is what prevents catastrophe.

Why encrypted patient data almost always counts as a breach

A misconception we still hear is that if ransomware only locks data rather than copying it, no breach has occurred and nothing needs to be reported. US regulators closed that door years ago. The HHS Office for Civil Rights has made clear that when ransomware encrypts electronic protected health information, the data has been acquired by an unauthorized actor, and that is a reportable breach unless the organization can demonstrate a low probability that the information was compromised, through a documented four-factor risk assessment.

That matters enormously for what happens after an attack. A hospital that can show, with evidence, exactly what the attacker touched and whether data actually left the building can make a defensible, accurate breach determination. A hospital that cannot is forced into worst-case notification, and is far more exposed if regulators later ask to see its risk analysis. In modern healthcare attacks, which are overwhelmingly double extortion, the data is stolen before anything is encrypted, so assuming a breach occurred is usually the safe starting point.

The blind spot almost every hospital shares

The single hardest part of defending a hospital is the connected medical devices. A large hospital runs ten to fifteen thousand of them: infusion pumps, imaging and PACS controllers, patient monitors, lab analyzers, and more. Most cannot run a security agent, because they use closed or embedded operating systems and their regulatory certification often forbids modifying them. That means a conventional endpoint tool is structurally blind to the majority of the real attack surface, and attackers know it.

This is not a theoretical weakness. Across the public record, attackers reach hospitals through a device or a credential that endpoint security never sees, then move toward the electronic health record and the backups. Any serious plan to protect patient data has to account for the systems you cannot put an agent on, not just the laptops and servers you can.

What actually keeps a hospital running through an attack

Prevention still matters, but a decade of incidents has made one thing plain: you cannot assume an attack will never get through, so the deciding factor is what happens next. The hospitals that come through intact treat ransomware as a resilience problem, not just a detection problem. In practice, that means four capabilities working together.

• Detection that reads behavior, not just signatures, so a stolen-credential intrusion with no malware is still caught, including on the agentless devices endpoint tools cannot see.
• Containment that works in seconds rather than minutes, isolating a threat before it reaches the EHR, with any action that could affect patient care gated behind one-click human approval.
• Recovery from verified, immutable, air-gapped backups that attackers cannot alter or delete, restored in clinical priority order and validated clean before returning to service.
• An immutable, tamper-proof audit trail that records exactly what happened, so the breach determination and regulatory notification rest on evidence rather than guesswork.

How Immune approaches it

This is the gap we built Immune to close. We watch the network and hosts continuously, fuse behavioral, deception, and access signals into one explainable verdict, and contain a confirmed threat automatically, within seconds, while holding any care-impacting action for human approval. We protect the connected medical devices at the network boundary rather than requiring an agent on each one, and we restore clinical systems from immutable backups in care-priority order, identity and network first, then the EHR, then imaging, lab, and pharmacy.

Crucially for patient data, every detection, decision, and recovery step is written to a tamper-proof, hash-chained audit log, and our network-level detection is tuned to surface the large, abnormal data transfers that precede a double-extortion leak. The goal is simple to state and hard to achieve: keep the hospital caring for patients through the attack, and be able to prove exactly what happened to their data afterward. That is what resilience means in a hospital, and it is the standard we hold ourselves to.