Industry · Healthcare And Pharma
Keep Patient Data And Research Off Criminal Markets.
Hospitals, clinics and drug makers hold data that criminals pay for. Watching criminal markets and supplier exposure shows you where it may be heading.
In Short
Hospitals and drug makers hold patient records and research that criminals value, and they cannot afford long outages. Attacks often begin with stolen logins, exposed remote access or a supplier. Watching outside the network shows ransomware, leaked patient data and supplier exposure early.
At A GlanceRansomware, stolen staff logins, patient data on leak sites and supplier exposure at hospitals and drug makers, and the rules that apply.
Main Threats
What Threatens Hospitals And Drug Makers.
Glossary term Ransomware
CISA lists exposed remote services, compromised credentials and phishing among the ways ransomware actors get in. Care and research depend on systems that cannot stay locked. See The Definition →
Glossary term Stolen Logins
Infostealer malware copies saved passwords from staff devices. The logs are sold and the logins reused. See The Definition →
Glossary term Patient Data On Leak Sites
Groups that steal data may post it on leak sites to force a payment. See The Definition →
Glossary term Supplier Exposure
Billing firms, clinical software vendors and device makers hold your data or connect to your systems. See The Definition →
Compliance
Which Rules Apply To You.
NIS2 Directive
The European Commission lists healthcare among the sectors the directive covers. It asks covered entities to take appropriate cybersecurity risk-management measures and to notify authorities of significant incidents, and applies to medium-sized and large entities. Official Site ↗
GDPR
The EU's main data protection law. It applies to organizations established in the EU that process personal data, and to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior. Official Site ↗
Products
How Brandefense Helps.
- Dark Web Monitoring Alerts you when staff logins or patient and research data tied to you appear in criminal markets.
- Ransomware Intelligence Follows ransomware groups and the victims they announce, so you see activity in health before it reaches you.
- External Attack Surface Management Shows exposed remote access and forgotten systems at your sites.
Threat Landscape
Who Targets Healthcare And Pharma, And Where.
8Base
Disrupted
8Base is the name of a ransomware affiliate group that used the Phobos ransomware.
Akira ransomware group
Active
Akira is a ransomware group active since March 2023.
ALPHV / BlackCat
Disrupted
ALPHV Blackcat is a ransomware as a service operation.
Black Basta ransomware group
Ransomware group
Black Basta is a ransomware as a service operation, first identified in April 2022.
Conti ransomware group
Inactive
Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK.
Everest
Active
Everest is a financially motivated ransomware and data extortion group.
Hive
Disrupted
Hive was a ransomware as a service operation active from June 2021.
LockBit
Disrupted
LockBit is a ransomware as a service operation first seen in January 2020.
Medusa
Active
Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS.
Play
Active
Play, also called Playcrypt, is a ransomware group active since June 2022.
Qilin
Active
Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022.
RansomHub
Ransomware group
RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024.
Rhysida
Active
Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023.
Royal
Ransomware group
Royal is a ransomware group that, according to a joint FBI and CISA advisory (AA23-061A, first published March 2, 2023), rebranded as BlackSuit.
Warlock
Ransomware group
Warlock is a ransomware family that Microsoft says a China-based actor it tracks as Storm-2603 deployed in July 2025 after exploiting on-premises SharePoint servers.
AIIMS Delhi cyber attack, 2022
Incident
On 23 November 2022 the servers of the All India Institute of Medical Sciences (AIIMS) in New Delhi went down in a cyber attack that some reports called ransomware.
Change Healthcare ransomware attack (February 2024)
Incident
The Change Healthcare ransomware attack of February 2024 hit a UnitedHealth Group company that moves claims and payments between providers, pharmacies and health plans.
ConecteSUS and Ministry of Health systems attack, Brazil, 2021
Incident
On 10 December 2021 the Brazilian Ministry of Health website, the ConecteSUS app and several national health systems went offline after an attack on the ministry's cloud environment.
Dutch cervical cancer screening lab breach, July 2025
Incident
In July 2025 hackers broke into a laboratory in Rijswijk that analyses cervical cancer screening tests for the Dutch national screening organization.
HSE Conti ransomware attack
Incident
In May 2021 Conti ransomware hit Ireland's Health Service Executive (HSE), the public health service.
Lazio Region ransomware attack on the regional health system
Incident
In the night between 31 July and 1 August 2021, a ransomware attack hit the data center that runs the IT systems of the Lazio Region in Italy and its health services.
Newfoundland and Labrador health system ransomware attack (2021)
Incident
In October 2021 the Hive ransomware group attacked the health information systems of Newfoundland and Labrador, Canada.
Romanian hospital information system ransomware attack
Incident
The Romanian hospital information system ransomware attack hit the servers behind the hospital information system (HIS) used by many Romanian hospitals in the night of 11 to 12 February 2024.
SingHealth patient database attack, 2018
Incident
Between August 2017 and July 2018 an attacker broke into the network of SingHealth, Singapore's largest public healthcare group, and copied the records of almost 1.5 million patients, mainly names, ID numbers, addresses and dates of birth.
Synnovis NHS pathology ransomware attack
Incident
On 3 June 2024 Synnovis, the pathology (blood test) provider for several London NHS hospitals, was hit by a ransomware attack that affected almost all of its IT systems.
WannaCry ransomware attack on the NHS in England
Incident
On Friday 12 May 2017 the WannaCry ransomware, released worldwide, locked computers across the NHS in England.
Australia
Country
Australia faces state-linked espionage, ransomware and large-scale customer data theft.
Brazil
Country
Brazil faces banking trojans and fraud, ransomware against health services and other organizations, and state-linked campaigns.
Canada
Country
Canada faces state espionage, ransomware against hospitals, governments and critical infrastructure, and pro-Russia denial of service campaigns.
France
Country
France faces espionage by state-linked groups, data theft and ransomware, and attacks around big events such as the Paris 2024 Games.
Germany
Country
Germany faces cyber espionage by state actors, ransomware against companies and local governments, and DDoS campaigns against critical infrastructure.
India
Country
India is one of the world's largest digital economies, and its government reports millions of cyber incidents a year, with over 29.44 lakh handled by CERT-In in 2025.
Indonesia
Country
Indonesia is a large digital economy where cyber risk is shaped by ransomware, data leaks and fraud against banks and public bodies.
Ireland
Country
Ireland is a European country whose national cyber center (NCSC) leads the response to major cyber incidents.
Israel
Country
Israel is a small, highly connected country that faces frequent cyber activity linked to the region's conflicts.
Italy
Country
Italy faces ransomware, DDoS campaigns by pro-Russian groups and data exposure.
Netherlands
Country
The Netherlands faces cyber espionage by Russian and Chinese state actors, ransomware, DDoS attacks and data leaks through suppliers.
Pakistan
Country
Pakistan appears in MITRE ATT&CK and US government texts as a target of South Asian and Chinese espionage groups and as one of the nations a North Korean bank-robbing team likely targeted.
Poland
Country
Poland faces cyber threats from state-linked actors such as APT28, Sandworm and Dragonfly, and from ransomware families such as LockBit.
Romania
Country
Romania is targeted by Russian state-linked actors and hacktivists, according to official sources.
Singapore
Country
Singapore faces state-linked espionage against its critical infrastructure, ransomware against businesses and a large volume of botnet infections.
South Africa
Country
South Africa has seen ransomware against national departments and state companies, and large leaks of personal data.
Taiwan
Country
Taiwan faces constant cyber pressure that its National Security Bureau ties to China: 2.63 million intrusion attempts a day against critical infrastructure in 2025, by the Bureau's count.
Türkiye
Country
Türkiye faces cyber threats from state-linked groups and criminals.
United Kingdom
Country
The United Kingdom faces cyber threats from states and from ransomware crews.
United States
Country
This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know.
FAQ
Frequently Asked Questions.
-
Can this protect medical devices?
No. It looks from the outside at what is exposed and at criminal sources. It does not manage devices on your network.
-
Does it show patient data?
It shows that data tied to your domains was found and where. Keep access to findings small and follow your privacy rules.
-
Which rules apply?
NIS2 covers healthcare in the EU and GDPR covers personal data. Other national rules apply, so check with your compliance team.
-
Do you name groups that target health?
No. We name a group only when a government or standards source links it to the sector. Most attackers here are criminals.
-
How do attackers get into hospitals and drug makers?
CISA lists exposed remote services, compromised credentials and phishing among the ways ransomware actors get in. Attacks also often begin with a supplier. Watching outside the network helps you see these openings early.
-
Why should a hospital follow ransomware groups?
Care and research depend on systems that cannot stay locked. Ransomware Intelligence follows ransomware groups and the victims they announce. That lets you see activity in health before it reaches you.
-
How do stolen staff logins end up for sale?
Infostealer malware copies saved passwords from staff devices. The logs are sold and the logins are reused. Dark Web Monitoring alerts you when staff logins or patient and research data tied to you appear in criminal markets.
-
Why do suppliers matter for healthcare security?
Billing firms, clinical software vendors and device makers hold your data or connect to your systems. A weakness at one of them can become your problem. External Attack Surface Management shows exposed remote access and forgotten systems at your sites, and its Third-Party Risk Management module gives a view of supplier exposure.
-
Why do attackers post stolen patient data on leak sites?
Groups that steal data may post it on leak sites to force a payment. Dark Web Monitoring alerts you when patient and research data tied to you appear in criminal markets. Seeing it early gives your team time to act.
-
How can a drug maker find research documents where they should not be?
Data leak detection looks for your documents and code in places where they should not be. Hospitals and drug makers hold patient records and research that criminals value. Finding a leak early lets you respond before it spreads.
Mentioned In
- Safeguarding Patient Data: Cybersecurity Solutions for the Healthcare Sector →April 2025
- Utilizing DRPS to Combat Emerging Cyber Threats in the Healthcare Sector →January 2024
- Ransomware in U.S. Healthcare: Threat Landscape, Impact, and Mitigation Strategies →May 2026
- Silent Chollima: North Korea’s Dual-Track Cyber Weapon →December 2025
- APT Groups in the MENA Region: Key Threat Actors in Cyber Espionage →October 2025
- Digital Twins: The Virtual Powerhouses Reshaping Cybersecurity →June 2025
Related Reading.
Knowledge Hub →
101 guide
Threat Intelligence 101
A plain introduction to threat intelligence: what it is, how it works and how a small team can start using it. Open →
101 guide
External Attack Surface Management 101
How to find, check and reduce everything an attacker could reach from the internet, and how to keep that list true as your company changes. Open →
101 guide
Phishing 101
What phishing is, why it keeps working and the practical steps that reduce the risk for your company and your customers. Open →
Other Ways In.
All Roles →
RoleCISOSee what is exposed outside your network in terms a board understands, and know what to…
RoleCIO and IT directorSee what your company exposes to the internet, which suppliers carry risk into your systems, and…
ArticleA Guide to Cloud Security for SMEs: Key Steps to Mitigate RisksCloud security guide for SMEs: the main risks small businesses face in cloud environments, and practical…
ArticleBuilding Cyber Resilience: Strategies for Navigating Complex ThreatsCyber resilience helps an organization anticipate, recover from and adapt to attacks. See how risk checks,…
For Healthcare And Pharma
Stay Ahead Of Digital Threats.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.