Data at rest is information that is stored, on a disk, in a database, or in a backup. Data in transit is information that is moving across a network between systems. Both states must be protected, usually through encryption, and both are relevant to ransomware and compliance.
The two states of data
Any piece of information in an organization is, at any moment, in one of two states, and understanding the distinction matters because each state faces different risks and needs different protection. Data at rest is data that is sitting still: files stored on a hard drive, records in a database, documents in a file share, copies in a backup. It is not moving anywhere; it is simply being kept. Data in transit is data that is moving: a record being sent from a workstation to a server, a file uploaded to the cloud, a message traveling across the internet, information flowing between a medical device and a monitoring system.
A third state, data in use, describes data actively being processed in memory, but the two that dominate security and compliance discussions are at rest and in transit. Nearly all data spends most of its life at rest and periodically moves in transit, and a complete protection strategy has to secure it in both states, because an attacker can target it in either one: stealing stored data from a compromised system, or intercepting it as it moves across a network.
How each state is protected
Encryption is the primary protection for both states, applied differently to each. Encrypting data at rest means storing it in an encrypted form, so that if an attacker gains access to the disk, database, or backup, or if a device is physically stolen, the data they obtain is unreadable scrambled ciphertext rather than usable information. Encrypting data in transit means protecting it as it travels, so that anyone intercepting the connection sees only encrypted traffic; the padlock in a web browser and the protocols behind it are everyday examples of in-transit encryption at work.
Beyond encryption, each state has supporting protections. Data at rest is also protected by access controls that limit who can reach the stored data in the first place, and by the physical and logical security of where it is kept. Data in transit is protected by secure, authenticated connections that confirm both ends are who they claim to be, preventing an attacker from inserting themselves into the conversation. Together, these ensure data is defended whether it is sitting still or on the move.
Why both states matter for ransomware
Ransomware interacts with both states in important ways. The data-theft stage of a double-extortion attack is fundamentally about data in transit: the attacker moves stolen data across the network and out of the environment, and detecting that abnormal in-transit flow is one of the best chances to catch exfiltration in progress. The encryption stage weaponizes the concept of data at rest, scrambling stored data so its owner cannot read it, which is the mirror image of defensive encryption.
Defensive encryption of data at rest also directly blunts the double-extortion threat. If sensitive data is stored encrypted, then when an attacker steals it, what they obtain is far less useful, because they have the ciphertext but not necessarily the means to read it, which weakens their leverage to threaten a leak. This is why encrypting data at rest is not only a compliance measure but a genuine reduction in the harm an exfiltration attack can do. Protecting both states is therefore part of a coherent defense: encryption at rest limits the value of what is stolen, and visibility into data in transit gives a chance to catch the theft as it happens.
Both states in healthcare and compliance
For healthcare, protecting data in both states is an explicit expectation of the HIPAA Security Rule, which addresses safeguarding protected health information whether it is stored or transmitted. Encryption of both at-rest and in-transit protected health information is strongly encouraged, and it carries a specific benefit: if data is properly encrypted and the keys are not compromised, a loss of that data may not rise to a reportable breach, because the information is not readable. This makes encryption of both states one of the most valuable investments a healthcare organization can make, protective of patients and helpful in managing breach exposure at once.
The practical complication in a hospital is the sheer volume and movement of data across a connected environment. Protected health information flows constantly between the electronic health record, imaging and lab systems, and the thousands of connected medical devices, so it is continually shifting between at rest and in transit across a vast attack surface. Securing it fully requires both encrypting it wherever it is stored and having visibility into it wherever it moves, including across the device connections that conventional tools struggle to see. An organization that protects data in both states, and can watch the in-transit flows for the signs of theft, has closed one of the most important gaps an attacker would otherwise exploit. This overview describes general practice and is not legal advice; organizations should consult their own compliance and legal teams.
See also
Sources
Definitions are drawn from the cited sources and were current as of publication. Content was rephrased for compliance with source licensing.