Healthcare organizations averaged 102,209 malware hits per firewall during the first half of 2026, roughly four times the volume recorded by the next most targeted industry [1]. That figure comes from SonicWall's State of Healthcare Cybersecurity report. Alongside the raw volume, the sector posted an 83% attack retention rate, reportedly the highest of any tracked vertical [1]. Attacks don't spike and recede. They accumulate.
The more operationally significant finding sits underneath the volume numbers: 100% of the vulnerabilities exploited against healthcare organizations in the period analyzed by Securin (January 2025 through February 2026) were already cataloged in CISA's Known Exploited Vulnerabilities (KEV) list [5]. Attackers are not burning zero-days on hospitals. They are walking through doors that have been publicly documented, sometimes for years.
The KEV Problem Is the Defining Structural Failure
Securin's healthcare cyber threat intelligence report analyzed 592 incidents across 94 ransomware groups between January 2025 and February 2026 [5]. Approximately 59% of those incidents involved ransomware. A healthcare organization was hit roughly every 10 hours. Every single vulnerability chain used in those attacks had a corresponding KEV entry.
This means defenders had prior, public warning for every exploited flaw. The issue isn't a lack of intelligence. It's the gap between awareness and remediation.
Healthcare environments run complex networks of clinical systems, medical devices, and legacy platforms that can't be patched on standard enterprise cycles. Firmware updates on infusion pumps or imaging systems require vendor coordination, downtime scheduling, and clinical risk assessment. Attackers understand that gap and operate inside it.
SonicWall's data makes the consequences concrete. Legacy vulnerabilities like CVE-2021-36260, a command injection flaw in Hikvision cameras first disclosed in 2021, remain actively exploited against healthcare networks [1]. That CVE has been public for five years. It has been in the KEV catalog for most of that time. It is still being used to gain initial access.
Remote access infrastructure is another persistent target shaped by unpatched KEV entries. SonicWall detected 13.3 million UltraVNC exploitation attempts across the healthcare sector in the first five months of 2026 [1]. UltraVNC buffer overflow vulnerabilities are well documented. The volume of exploitation attempts indicates widespread exposure across healthcare environments that depend on remote access for clinical workflows and vendor support.
The Change Healthcare Breach Illustrates Systemic Weakness
The Change Healthcare ransomware attack in 2024 remains the most consequential example of what happens when known security gaps go unaddressed in a systemically important healthcare entity. That single incident disrupted claims processing nationwide, compromised the medical data of approximately 190 million individuals, and resulted in a $22 million ransom payment [3]. The attack path relied on compromised credentials used to access a Citrix remote access portal that lacked multifactor authentication.
Change Healthcare processed approximately 15 billion healthcare transactions annually before the breach [3]. When it went down, providers across the country lost the ability to submit claims, verify insurance eligibility, and process prescriptions. The financial impact extended well beyond the ransom payment itself.
This incident demonstrated that a single vendor compromise can cascade across the entire sector. Available reporting indicates that over 80% of stolen protected health information records now originate from third-party vendors rather than the breached organizations themselves [3]. Supply chain compromise has become the dominant vector for large-scale healthcare data exposure.
Attack Volume Refuses to Decline at Industry Pace
Healthcare recorded the smallest attack decline of any tracked vertical. While intrusion prevention system (IPS) attack volumes dropped across most industries, healthcare saw only a 16.9% decrease [1]. SonicWall recorded 16.6 million ransomware detections across 10 active ransomware families targeting the sector [1].
The retention rate tells the story. At 83%, healthcare's attack retention rate means the vast majority of threat activity persists from one measurement period to the next [1]. Other industries see sharper drops as attackers shift focus. Healthcare doesn't get that relief because its structural conditions (legacy devices, complex vendor relationships, and regulatory constraints on downtime) remain constant.
Exploitation spanned 243 unique attack signatures targeting healthcare IoT devices [1]. Connected medical devices represent a particularly difficult remediation challenge. Many run embedded operating systems that can't be patched without the device manufacturer's involvement. Some devices are no longer supported by their manufacturers at all.
Clinical Outcomes Are Directly Affected
A joint study by Proofpoint and the Ponemon Institute found that nearly all healthcare entities experienced at least one cyberattack in the past year, with an average of more than 40 incidents per organization [4]. Nearly three in four U.S. healthcare organizations reported that those attacks disrupted patient care [4]. About half reported increased medical procedure complications and longer patient stays. Approximately one in four to one in three respondents linked cyber incidents to higher patient mortality rates [4].
These are clinical outcomes, not IT metrics. When a ransomware attack takes down an electronic health record system or disables imaging equipment, the downstream effect is measured in treatment delays, diagnostic errors, and patient diversions to other facilities.
The sector's sustained exposure is the product of specific structural conditions that multiple threat groups have learned to exploit systematically.
Regulatory Pressure Is Increasing
Clearwater Security leadership has described the current risk environment as defined by compounding, interconnected failure rather than isolated incidents [3]. That framing fits the data. Third-party incidents now routinely impact dozens or hundreds of organizations simultaneously.
The Senate Health, Education, Labor, and Pensions (HELP) Committee has been considering legislation aimed at strengthening cybersecurity requirements for healthcare entities, including mandatory incident reporting timelines and minimum security standards for business associates handling protected health information [3]. The regulatory direction is toward treating cybersecurity as a patient safety issue rather than a compliance checkbox.
Analysis
The KEV finding from Securin's data is the most actionable signal in the current threat picture. It means that prioritizing KEV remediation, specifically for internet-facing and remote access systems, would have addressed every vulnerability chain used in the 592 incidents recorded during the study period. This is a direct mapping between a specific defensive action and the actual attack surface being exploited.
The persistence of CVE-2021-36260 and UltraVNC exploitation at the volumes reported by SonicWall strongly suggests that healthcare organizations likely have incomplete asset inventories, particularly for IoT and remote access infrastructure. You can't patch what you don't know you have.
The 83% retention rate suggests that attackers view healthcare as a reliable, repeatable target. The combination of high-value data, payment willingness (due to clinical urgency), and slow remediation cycles makes the sector attractive to both financially motivated groups and initial access brokers who sell footholds to ransomware operators.
Red Sheep Assessment
Confidence: High
The convergence of SonicWall's volume data and Securin's KEV analysis points to a straightforward conclusion: the healthcare sector's security deficit is concentrated in known vulnerability management, not in defending against novel threats. Every exploited vulnerability in the Securin study period had a public advisory and a KEV listing. The problem is execution speed, not intelligence availability.
The 13.3 million UltraVNC exploitation attempts and the continued exploitation of a five-year-old Hikvision CVE suggest that many healthcare organizations lack continuous asset discovery and vulnerability scanning for non-traditional IT assets (cameras, remote access servers, IoT devices). Traditional vulnerability management programs focused on servers and workstations miss these categories entirely.
The third-party concentration of data breaches (reporting indicates over 80% of stolen records originating from vendors) suggests that even organizations with strong internal programs face substantial residual risk from their supply chains. The regulatory push toward minimum standards for business associates is a direct response to this gap, but implementation timelines will likely lag the threat.
A contrarian reading holds that the 16.9% decline in IPS attack volumes could signal the beginning of a plateau. The retention rate data does not support that interpretation. The decline is the smallest of any sector, and the retention rate indicates the underlying threat activity is persistent, not receding.
Defender's Checklist
- ▢[ ] Audit all internet-facing assets against the current CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Prioritize CVE-2021-36260 (Hikvision command injection), UltraVNC buffer overflow CVEs, remote access tools (VNC variants, RDP gateways), and IoT devices for immediate remediation or compensating controls. Align remediation timelines with CISA BOD 22-01 per-CVE deadlines.
- ▢[ ] Conduct an asset discovery sweep specifically targeting network-connected medical devices, cameras, and remote access infrastructure. Cross-reference results against your existing CMDB to identify unmanaged or unknown devices. Tools like Runzero, Claroty, or Medigate can assist with healthcare IoT discovery.
- ▢[ ] Review all business associate agreements for cybersecurity requirements. Verify that third-party vendors handling PHI meet minimum patching SLAs and can demonstrate KEV remediation within CISA-mandated timelines.
- ▢[ ] Deploy network segmentation between clinical device VLANs and general enterprise networks. Block outbound internet access from medical device segments except through explicit allow-list proxies. Monitor east-west traffic from IoT segments for anomalous connections.
- ▢[ ] Establish a recurring KEV review cadence (weekly at minimum) mapped to your vulnerability management program. Track mean-time-to-remediate for KEV entries separately from general vulnerability SLAs and report it to leadership as a patient safety metric.
References
- https://www.esecurityplanet.com/threats/healthcare-cybersecurity-threats-persist-in-2026/
- https://www.e-channelnews.com/sonicwall-research-sounds-code-red-on-healthcare-cybersecurity-as-attack-rates-refuse-to-decline/
- https://www.clearwatersecurity.com/healthcare-cybersecurity-outlook-2026/
- https://www.proofpoint.com/us/newsroom/press-releases/proofpoint-and-ponemon-institute-report-reveals-impact-cyberattacks-patient
- https://www.securin.io/healthcare-sector-cyber-threat-intelligence-report-q1-2026